PT-2025-39348 · Flagforge · Flagforge

Sarthakkc36 · Publicado 2025-09-24 · Atualizado 2025-10-25 · CVE-2025-59827

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flag Forge versions prior to 2.2.0

Description Flag Forge is a Capture The Flag (CTF) platform. The /api/admin/assign-badge endpoint lacks proper access control, allowing any authenticated user to assign high-privilege badges, such as Staff, to themselves. This can lead to privilege escalation and impersonation of administrative roles.

Recommendations Versions prior to 2.2.0 should be updated to version 2.2.0 or later.

Exploit

Correção

LPE

RCE

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-59827

GHSA-7944-XVV7-CV79

Produtos afetados

Flagforge

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59827.json · Exploit
• https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-7944-xvv7-cv79 · Aviso do Fabricante
• https://t.me/CVEtracker/33303 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1971015501988974884 · Publicação no Twitter
• https://twitter.com/Unit42_Intel/status/1981878899878285561 · Publicação no Twitter
• https://t.me/cveNotify/137842 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-59827 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-59827 · Nota de Segurança
• https://twitter.com/CVEnew/status/1970996070277841342 · Publicação no Twitter