Back to Database
Status published
High
CVE-2025-59932
FlagForgeCTF Unauthenticated Resource Modification/Deletion
Vulnerability Description
Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the platform. The issue has been fixed in FlagForge version 2.3.1.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59932
Credits & Attribution
No credits recorded in the NVD database.
More from FlagForgeCTF
View All →CVE-2025-61777
FlagForge Allows Unauthenticated Badge Template API Access
Critical
9.4
CVE-2025-59843
FlagForgeCTF Exposes User Emails via Public /api/user/[username] API
Medium
6.9
CVE-2025-59841
FlagForgeCTF's Improper Session Handling Allows Access After Logout
Critical
9.8
CVE-2025-59833
FlagForgeCTF Hint Exposure via API
High
7.5
CVE-2025-59827
FlagForgeCTF is Missing Authorization in main-v2
High
8.2
Affected Vendor
FlagForgeCTF
View all reports →Affected Software
flagForge
Vulnerable Versions:
>= 2.0.0, < 2.3.1
Timeline
Official Publish:
September 27th, 2025
Last Modified:
September 29th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L