CVE-2025-59843: Flagforge Information Disclosure Flaw

CVE-2025-59843 Overview

Flag Forge is an open-source Capture The Flag (CTF) platform. The application exposes an information disclosure vulnerability in versions 2.0.0 through 2.3.1. The public endpoint /api/user/[username] returns registered user email addresses within its JSON response, allowing unauthenticated actors to harvest personal data.

The issue is tracked as CWE-359: Exposure of Private Personal Information to an Unauthorized Actor. The fix was intended for 2.3.1 but only shipped in version 2.3.2, which removes email addresses from the API response while keeping the endpoint publicly accessible.

Critical Impact

Unauthenticated attackers can enumerate usernames and retrieve associated email addresses via the public profile API, enabling targeted phishing and credential stuffing campaigns against Flag Forge users.

Affected Products

• Flag Forge CTF platform versions 2.0.0 through 2.3.1
• The public REST endpoint /api/user/[username]
• Self-hosted deployments of FlagForgeCTF/flagForge from GitHub

Discovery Timeline

• 2025-09-26 - CVE-2025-59843 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59843

Vulnerability Analysis

The vulnerability resides in the public user profile API route implemented in app/api/user/[username]/route.ts. The handler performs a case-insensitive lookup against the UserSchema collection and returns the resulting document. The original Mongoose .select() projection explicitly included the email field alongside public profile attributes like name, image, totalScore, customBadges, createdAt, and role.

Because the endpoint requires no authentication, any remote client can issue a GET request against a known or guessed username and receive the associated email address in the JSON response. This constitutes exposure of personal information [CWE-359] with network-level reachability and no user interaction required.

Root Cause

The root cause is over-inclusive field projection in the Mongoose query used to serve the public profile endpoint. The developer included email in the .select() string, treating a private identifier as a public profile attribute. There was no downstream response filtering to strip sensitive fields before serialization.

Attack Vector

An unauthenticated attacker with network access to a Flag Forge instance can enumerate accounts by iterating known or scraped usernames against /api/user/<username>. Each successful response returns the account holder's email address. Harvested addresses can be weaponized for spear phishing, correlation with breach databases, or CTF-specific social engineering.

// Patch from app/api/user/[username]/route.ts
// Before (vulnerable): email included in projection
-    const user = await UserSchema.findOne({ 
-      name: { $regex: new RegExp(`^${username}$`, 'i') } 
-    }).select('name email image totalScore customBadges createdAt role');

// After (patched): email removed from public projection
// The endpoint remains public but no longer discloses email addresses

Source: GitHub commit 1b033f1

Detection Methods for CVE-2025-59843

Indicators of Compromise

• Elevated request volume to /api/user/* from a single source IP, suggesting username enumeration
• HTTP 200 responses from the endpoint containing an email JSON field on vulnerable versions
• Sequential or dictionary-ordered username requests within short time windows
• Requests to the endpoint from unfamiliar user agents or automated tooling signatures

Detection Strategies

• Inspect web server or reverse proxy access logs for GET /api/user/ patterns and count unique usernames requested per source
• Add response body inspection at the WAF layer to alert when the email field appears in outgoing JSON from vulnerable versions
• Verify the running Flag Forge version against the fixed release 2.3.2 and flag any older deployments

Monitoring Recommendations

• Enable rate limiting and alerting on the /api/user/[username] route
• Forward application and reverse proxy logs to a centralized analytics platform for enumeration pattern detection
• Correlate enumeration bursts with subsequent authentication attempts or password reset traffic

How to Mitigate CVE-2025-59843

Immediate Actions Required

• Upgrade Flag Forge to version 2.3.2 or later without delay
• Audit reverse proxy and application logs for prior enumeration of /api/user/* and identify potentially exposed users
• Notify affected users if email harvesting is confirmed, and advise heightened vigilance against phishing
• Rotate any secondary credentials that may have been distributed via the exposed email addresses

Patch Information

The fix is available in Flag Forge 2.3.2. The remediation removes email from the Mongoose .select() projection in app/api/user/[username]/route.ts. Review the GitHub Security Advisory GHSA-qqjv-8r5p-7xpj and the v2.3.1 to v2.3.2 diff before deploying.

Workarounds

• No official workarounds exist; the vendor advisory explicitly states upgrading is the only remediation
• As a temporary compensating control, block or restrict access to /api/user/[username] at the reverse proxy until the upgrade is completed
• Apply strict rate limiting on the endpoint to slow enumeration if immediate upgrade is not feasible

# Example nginx compensating control until upgrade to 2.3.2
location ~ ^/api/user/ {
    limit_req zone=api_user burst=5 nodelay;
    # Or block entirely during remediation window:
    # return 403;
}