CVE-2025-59843 - CVE House
Back to Database
Status published Medium CVE-2025-59843

FlagForgeCTF Exposes User Emails via Public /api/user/[username] API

Vulnerability Description

Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public API responses while keeping the endpoint publicly accessible. Users should upgrade to version 2.3.2 or later to eliminate exposure. There are no workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59843

Credits & Attribution

No credits recorded in the NVD database.

References

More from FlagForgeCTF

View All →
CVE-2025-61777
FlagForge Allows Unauthenticated Badge Template API Access
Critical 9.4
CVE-2025-59932
FlagForgeCTF Unauthenticated Resource Modification/Deletion
High 8.6
CVE-2025-59841
FlagForgeCTF's Improper Session Handling Allows Access After Logout
Critical 9.8
CVE-2025-59833
FlagForgeCTF Hint Exposure via API
High 7.5
CVE-2025-59827
FlagForgeCTF is Missing Authorization in main-v2
High 8.2

Affected Vendor

FlagForgeCTF

View all reports →

Affected Software

flagForge
Vulnerable Versions:
>= 2.0.0, < 2.3.2

Timeline

Official Publish: September 26th, 2025
Last Modified: January 28th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-359

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.