Information Exposure in Flag Forge CTF Platform

CVE-2025-59843

What is CVE-2025-59843?

Flag Forge, a Capture The Flag (CTF) platform, has a vulnerability in its public API endpoint /api/user/[username] that exposes user email addresses in the JSON response. This issue affects versions 2.0.0 up to, but not including, 2.3.1. The vulnerability has been addressed in version 2.3.1, which removes user email information from responses while maintaining the endpoint's accessibility. Users are strongly advised to upgrade to version 2.3.1 or later to mitigate the risk of email exposure. No alternative workarounds are available to protect against this information leak.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References