CVE-2025-61777 is a critical (CVSS 9.4) missing authentication flaw in Flag Forge, a Capture The Flag platform. From version 2.0.0 up to but not including 2.3.2, two admin badge template endpoints worked without login or authorization. The fix is 2.3.2, and the project says there are no reliable workarounds.
What's affected
- Product: Flag Forge, a Capture The Flag (CTF) platform.
- Weaknesses: CWE-200 (exposure of sensitive information), CWE-284 (improper access control) and CWE-306 (missing authentication for a critical function).
- Affected: versions from 2.0.0 up to, but not including, 2.3.2.
- Fixed: 2.3.2. After the fix, GET, POST, UPDATE and DELETE endpoints require authentication, and authorization checks limit access to admins.
- Workarounds: none reliable, per the record.
- CVSS 3.1: 9.4, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. No login, no user interaction.
The two endpoints named in the record are the admin badge templates read route and the create route. Without checks, an outsider could list every badge template with its metadata (who created it and when) or create new templates.
How to check if you're exposed
Find the version your deployment runs. If you deploy from source, check the package file or the git tag:
grep '"version"' package.json
git describe --tags
If you run a container image, check its tag. Versions from 2.0.0 up to 2.3.1 are affected.
Then check exposure. Is your instance reachable from the internet, or only on an event network? CTF platforms are often public by design, so assume yes unless you know otherwise. Review access logs for requests to the admin badge template routes from users who are not administrators, and look in the database for badge templates nobody on your team created.
What to do now
- Upgrade Flag Forge to 2.3.2 or later and redeploy.
- Because the record lists no reliable workaround, if you cannot upgrade immediately, consider taking the instance offline or blocking the admin badge template routes at your proxy.
- Audit the badge template table. Remove entries you do not recognize and note any created at unexpected times.
- Review logs for requests to the admin routes without a session.
- After upgrading, confirm that the admin routes return an authorization error when called without credentials.
- Check the rest of your dependencies with the free in-browser dependency scan.
Why it matters
This is a plain access control failure. Admin routes were exposed without checking who was calling. CWE-306 is one of the most common web application mistakes: a developer builds an admin feature and the authentication check never gets attached to the route.
The impact described is data exposure, database pollution and abuse of the badge system. For a CTF platform that could mean spoiled or fake achievements, which is not catastrophic for most deployments but can undermine a competition or leak internal metadata. The vector is still rated high for confidentiality and integrity because the routes are open to anyone.
The fix is the right shape: require authentication on every method, then add role checks so only admins reach the routes. The record does not say this is exploited in the wild, and it is not in the CISA KEV catalog.
Quick check
Is there a workaround?
The record says no reliable workarounds are available. Upgrade to 2.3.2, or block the routes at a proxy if you must wait.
Which versions are affected?
Flag Forge from 2.0.0 up to but not including 2.3.2.
Sources
- github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-2 (fetched)
- Safeguard Gold entry for CVE-2025-61777
- github.com/FlagForgeCTF/flagForge/commit/e2121c5fb7a512a49dc (listed in the CVE record, not fetched)
Last reviewed: 18 October 2026.
