Unauthorized Resource Management in Flag Forge Capture The Flag Platform

CVE-2025-59932

What is CVE-2025-59932?

Flag Forge, a popular Capture The Flag (CTF) platform, is susceptible to an improper authentication vulnerability that affects versions from 2.0.0 up to, but not including, 2.3.1. The vulnerability is located at the /api/resources endpoint, which previously allowed POST and DELETE requests without adequate authentication or authorization measures in place. This oversight exposes the platform to unauthorized users, potentially enabling them to create, modify, or delete critical resources at will. Users are strongly advised to upgrade to version 2.3.1 where this issue has been addressed to ensure the security and integrity of their resources.

References