CVE-2026-121562
MediumCVSS 5.3Summary
CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.
Risk Assessment
Unauthenticated attackers can mass-collect participants' personal data, potentially violating privacy and data protection regulations.
Recommendation
Update CTFd to version 3.8.7 or later and consider restricting public visibility of team custom fields.
Other vulnerabilities in CTFd
See all- CVE-2025-29419High
CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack.
- CVE-2026-78145Medium
A vulnerability in CTFd up to 3.8.4 in the _is_safe_url function of the CTFd/utils/validators/__init__.py file. Manipulation of the Next argument leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch name is 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9. Upgrading the affected component is recommended.
- CVE-2024-46242High
In CTFd 3.7.3, the validate_email function in CTFd/utils/validators/__init__.py is vulnerable to a Regular expression Denial of Service (ReDoS) attack. An attacker can supply a crafted email address during registration, causing excessive server load.
Original NVD description (English source)
CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS