PT-2025-39348 · Flagforge · Flagforge

Sarthakkc36 · Published 2025-09-24 · Updated 2025-10-25 · CVE-2025-59827

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flag Forge versions prior to 2.2.0

Description Flag Forge is a Capture The Flag (CTF) platform. The /api/admin/assign-badge endpoint lacks proper access control, allowing any authenticated user to assign high-privilege badges, such as Staff, to themselves. This can lead to privilege escalation and impersonation of administrative roles.

Recommendations Versions prior to 2.2.0 should be updated to version 2.2.0 or later.

Exploit

Fix

LPE

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-59827

GHSA-7944-XVV7-CV79

Affected Products

Flagforge

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59827.json · Exploit
• https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-7944-xvv7-cv79 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59827 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59827 · Security Note
• https://t.me/CVEtracker/33303 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1971015501988974884 · Twitter Post
• https://twitter.com/Unit42_Intel/status/1981878899878285561 · Twitter Post
• https://t.me/cveNotify/137842 · Telegram Post
• https://twitter.com/CVEnew/status/1970996070277841342 · Twitter Post