CVE-2025-59843

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-59843", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-22T14:34:03.472Z", "datePublished": "2025-09-26T16:03:34.038Z", "dateUpdated": "2026-01-28T23:11:20.765Z"}, "containers": {"cna": {"title": "FlagForgeCTF Exposes User Emails via Public /api/user/[username] API", "problemTypes": [{"descriptions": [{"cweId": "CWE-359", "lang": "en", "description": "CWE-359: Exposure of Private Personal Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-qqjv-8r5p-7xpj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-qqjv-8r5p-7xpj"}, {"name": "https://github.com/FlagForgeCTF/flagForge/commit/1b033f1b6e20fbf6df422d5d1afc9b2347528ace", "tags": ["x_refsource_MISC"], "url": "https://github.com/FlagForgeCTF/flagForge/commit/1b033f1b6e20fbf6df422d5d1afc9b2347528ace"}, {"name": "https://github.com/FlagForgeCTF/flagForge/compare/v2.3.1...v2.3.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/FlagForgeCTF/flagForge/compare/v2.3.1...v2.3.2"}, {"name": "https://github.com/FlagForgeCTF/flagForge/releases/tag/v2.3.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/FlagForgeCTF/flagForge/releases/tag/v2.3.1"}], "affected": [{"vendor": "FlagForgeCTF", "product": "flagForge", "versions": [{"version": ">= 2.0.0, < 2.3.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-28T23:11:20.765Z"}, "descriptions": [{"lang": "en", "value": "Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public API responses while keeping the endpoint publicly accessible. Users should upgrade to version 2.3.2 or later to eliminate exposure. There are no workarounds for this vulnerability."}], "source": {"advisory": "GHSA-qqjv-8r5p-7xpj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-26T17:35:23.214953Z", "id": "CVE-2025-59843", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-26T17:51:22.644Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59843", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-26T17:35:23.214953Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-26T17:35:32.509Z"}}], "cna": {"title": "FlagForgeCTF Exposes User Emails via Public /api/user/[username] API", "source": {"advisory": "GHSA-qqjv-8r5p-7xpj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "FlagForgeCTF", "product": "flagForge", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.3.2"}]}], "references": [{"url": "https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-qqjv-8r5p-7xpj", "name": "https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-qqjv-8r5p-7xpj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/FlagForgeCTF/flagForge/commit/1b033f1b6e20fbf6df422d5d1afc9b2347528ace", "name": "https://github.com/FlagForgeCTF/flagForge/commit/1b033f1b6e20fbf6df422d5d1afc9b2347528ace", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/FlagForgeCTF/flagForge/compare/v2.3.1...v2.3.2", "name": "https://github.com/FlagForgeCTF/flagForge/compare/v2.3.1...v2.3.2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/FlagForgeCTF/flagForge/releases/tag/v2.3.1", "name": "https://github.com/FlagForgeCTF/flagForge/releases/tag/v2.3.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public API responses while keeping the endpoint publicly accessible. Users should upgrade to version 2.3.2 or later to eliminate exposure. There are no workarounds for this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-359", "description": "CWE-359: Exposure of Private Personal Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-28T23:11:20.765Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59843", "state": "PUBLISHED", "dateUpdated": "2026-01-28T23:11:20.765Z", "dateReserved": "2025-09-22T14:34:03.472Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-26T16:03:34.038Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "flagForge", "vendor": "FlagForgeCTF", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.3.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:flagforge:flagforge:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D25E326-D145-4129-B470-6B2D2520E03E", "versionEndExcluding": "2.3.1", "versionStartIncluding": "2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public API responses while keeping the endpoint publicly accessible. Users should upgrade to version 2.3.2 or later to eliminate exposure. There are no workarounds for this vulnerability."}, {"lang": "es", "value": "Flag Forge es una plataforma de Capture The Flag (CTF). Desde las versiones 2.0.0 hasta antes de la 2.3.2, el endpoint p\u00fablico /api/user/[username] devuelve las direcciones de correo electr\u00f3nico de los usuarios en su respuesta JSON. La correcci\u00f3n, prevista para su lanzamiento en la 2.3.1 pero solo disponible a partir de la versi\u00f3n 2.3.2, elimina las direcciones de correo electr\u00f3nico de las respuestas de la API p\u00fablica mientras mantiene el endpoint p\u00fablicamente accesible. Los usuarios deben actualizar a la versi\u00f3n 2.3.2 o posterior para eliminar la exposici\u00f3n. No hay soluciones alternativas para esta vulnerabilidad."}], "id": "CVE-2025-59843", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59843", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-26T17:35:23.214953Z", "version": "2.0.3"}}]}, "published": "2025-09-26T16:15:49.090", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/FlagForgeCTF/flagForge/commit/1b033f1b6e20fbf6df422d5d1afc9b2347528ace"}, {"source": "security-advisories@github.com", "url": "https://github.com/FlagForgeCTF/flagForge/compare/v2.3.1...v2.3.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/FlagForgeCTF/flagForge/releases/tag/v2.3.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-qqjv-8r5p-7xpj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-359"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-09-29T09:30:23.238541+00:00", "updated": "2025-09-29T09:30:23.238598+00:00", "vendors": ["flagforgectf", "flagforgectf$PRODUCT$flagforge"]}