CVE-2026-21868
HighSummary
Flag Forge versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint (/api/user/[username]). The application constructs a regular expression dynamically using unescaped user input (the username parameter). An attacker can exploit this by sending a specially crafted username containing regex meta-characters (e.g., deeply nested groups or quantifiers), causing the MongoDB regex engine to consume excessive CPU resources. This can lead to Denial of Service for other users. The issue is fixed in version 2.3.3. To workaround this issue, implement a Web Application Firewall (WAF) rule to block requests containing regex meta-characters in the URL path.
Risk Assessment
Risk of platform unavailability for other users due to CPU exhaustion.
Recommendation
Update Flag Forge to version 2.3.3 or later. If not possible, implement WAF rules to block requests with regex meta-characters in the URL.
Other vulnerabilities in Flag Forge
See all- CVE-2025-61777Critical
Flag Forge versions starting from 2.0.0 and prior to 2.3.2 had the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints accessible without authentication or authorization. This allowed unauthorized users to retrieve all badge templates and sensitive metadata and/or create arbitrary badge templates in the database. The issue is fixed in version 2.3.2.
- CVE-2025-59841Critical
Flag Forge (CTF platform) versions 2.2.0 up to before 2.3.1 improperly handle session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still valid post-logout, which can allow unauthorized actions. Patched in version 2.3.1.
- CVE-2025-59932High
Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the platform. The issue has been fixed in FlagForge version 2.3.1.
- CVE-2025-59843Medium
Flag Forge CTF platform versions 2.0.0 to before 2.3.2 expose user email addresses in the JSON response of the public endpoint /api/user/[username]. The fix, available from 2.3.2, removes emails from public API responses. No workarounds exist.
- CVE-2025-59826High
Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, non-admin users can create arbitrary challenges, potentially introducing malicious, incorrect, or misleading content. This has been patched in version 2.2.0.
Original NVD description (English source)
Flag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint (/api/user/[username]). The application constructs a regular expression dynamically using unescaped user input (the username parameter). An attacker can exploit this by sending a specially crafted username containing regex meta-characters (e.g., deeply nested groups or quantifiers), causing the MongoDB regex engine to consume excessive CPU resources. This can lead to Denial of Service for other users. The issue is fixed in version 2.3.3. To workaround this issue, implement a Web Application Firewall (WAF) rule to block requests containing regex meta-characters in the URL path.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS