CVE-2025-59827 is a critical (CVSS 9.8) missing authorization flaw in Flag Forge 2.1.0, a Capture The Flag platform. The assign-badge endpoint lets any authenticated user give themselves high privilege badges such as Staff. Upgrade to 2.2.0. The sections below cover who is affected, how to check, and what to do now.
What's affected
Per the NVD record, Flag Forge version 2.1.0 is affected and the issue is patched in version 2.2.0. The affected endpoint is /api/admin/assign-badge.
The GitHub advisory page was not available through the API when I checked, so the details here come from the record.
How to check if you're exposed
Find your running version from the application's package file or release tag.
grep '"version"' package.json
git describe --tags
Then check who holds high privilege badges in your instance and compare with the list of people who should. Look in the application logs for calls to the assign-badge endpoint, and check whether the callers were administrators.
What to do now
- Upgrade Flag Forge to 2.2.0 or later.
- Audit badge assignments for Staff and other privileged badges and revoke any that are not expected.
- Review logs for calls to /api/admin/assign-badge from non administrator accounts.
- Add a server side role check on every route under the admin path.
- If you host events, consider resetting scores or trust decisions that relied on badges.
Why it matters
The record maps this to CWE-862, missing authorization. The route sits under an admin path, yet it only requires a logged in user and does not verify that the user is an administrator. A path name is not an access control.
There is a mismatch in the record. The description says an authenticated user is needed, while the CVSS vector in the record lists privileges required as none, which is why the score reaches 9.8. If registration is open, the two come to nearly the same thing, since anyone can create an account. The impact described is privilege escalation and impersonation of administrative roles. It is not on the CISA KEV list.
Authorization flaws are different from authentication flaws. The user may be properly logged in, yet the application fails to check whether that user is allowed to perform the specific action. These bugs are common in APIs because every endpoint has to repeat the check, and one missing check is enough.
The most useful test is to try each privileged action as an ordinary user and as an anonymous one, and confirm the server refuses both. Automated tests that do this for every route catch the regression the next time someone adds an endpoint.
Safeguard can help you find this one in your own software. The free in-browser dependency scan at gold.safeguard.sh/scan reads your manifest or lockfile and shows which known vulnerabilities your declared dependencies carry, including transitive ones. Reachability analysis then helps you separate the places where your code actually calls the affected component from the places where it only sits in the tree, which makes it easier to decide what to patch first.
Quick check
Which version fixes CVE-2025-59827?
Flag Forge 2.2.0.
Does the endpoint name make it safe?
No. The server must check the caller's role, whatever the URL looks like.
Sources
- NVD record data for CVE-2025-59827
- GitHub advisory GHSA-7944-xvv7-cv79 (listed in the record)
Last reviewed: 18 October 2026.
