Authentication Bypass in Flag Forge CTF Platform

CVE-2025-61777

What is CVE-2025-61777?

Flag Forge, a popular Capture The Flag (CTF) platform, had a significant vulnerability that existed from version 2.0.0 up to 2.3.2. Specific API endpoints, namely /api/admin/badge-templates (GET) and /api/admin/badge-templates/create (POST), were accessible without proper authentication or authorization. This flaw permitted unauthorized users to access sensitive badge templates and critical metadata such as creation and modification details, or even to create arbitrary badge templates in the database. The potential consequences of this vulnerability included data exposure, unauthorized modification, and database integrity issues. Thankfully, the issue has been addressed in version 2.3.2, which enforces authentication and introduces strict authorization checks, making sure that only administrators can access and manage badge templates.

References