Flag Forge CVE-2025-59932

Exploitation requires only network reachability to the Flag Forge application's /api/resources endpoint on an instance running an affected version (2.0.0 through any release before 2.3.1); the attacker issues POST or DELETE requests with no credentials, because the endpoint previously performed no authentication or authorization check. Per CVSS AV:N/AC:L/PR:N/UI:N, there is no requirement for user interaction, prior authentication, or special configuration - it applies to default deployments of the vulnerable versions. The primary limiting factors are: the target must be an exposed/reachable Flag Forge instance in the vulnerable version range, and upgrading to 2.3.1 fully removes the condition. Impact is bounded to resource create/modify/delete (integrity, and availability via deletion); there is no confidentiality impact.

This is a broken access control flaw (CWE-284) in the Flag Forge CTF platform where the /api/resources endpoint accepted POST and DELETE requests without authentication or authorization. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, base 8.2) describes a network-reachable, low-complexity, unauthenticated issue with high integrity impact and low availability impact and no confidentiality impact - internally consistent with the description, which centers on unauthorized create/modify/delete of resources rather than data disclosure. However, the real-world exploitation signals point sharply downward: EPSS is only 0.06% (17th percentile), there is NO CISA KEV listing, and no public proof-of-concept was identified in the provided intelligence. The dominant risk-limiting factor is product footprint - Flag Forge is a niche open-source CTF platform, so even an easy-to-exploit, unauthenticated flaw affects very few production environments. Net assessment: a genuinely exploitable authorization gap with a plausibly high CVSS, but low practical priority outside of organizations actually running Flag Forge 2.0.0-2.2.x; those operators should patch to 2.3.1 promptly, while the broader population can treat this as low urgency. No signals conflict materially; the high CVSS reflects ease of access, not widespread or active exploitation.

An attacker who can reach the Flag Forge web application sends an unauthenticated POST or DELETE request directly to the /api/resources endpoint, bypassing the intended login/role checks. Because no authentication or authorization is enforced, the attacker can create, tamper with, or delete platform resources - for example wiping or injecting CTF challenge resources during an event. No public exploit code was identified, but the attack is trivial to craft given the network vector and low complexity (AC:L, PR:N, UI:N).