What is the CVSS score of CVE-2025-61777?

CVE-2025-61777 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2025-61777?

Within 24 hours, inventory every FlagForge deployment and identify which instances run versions 2.0.0 through 2.3.1, then restrict network reachability to the /api/admin/badge-templates GET and /api/admin/badge-templates/create endpoints so they are not exposed to untrusted networks, and review badge-template records for unexpected entries or unfamiliar metadata. Within 7 days, upgrade all affected instances to the vendor-released patch v2.3.2, verify the version post-upgrade, and rotate any administrative credentials or API tokens associated with the FlagForge admin interface as a precaution. Within 30 days, add badge-template integrity checks and change monitoring to detection baselines, confirm no unauthorized templates persist in production, and fold FlagForge into the routine patch-management and external attack-surface review cycle so future releases are validated against the supported version.

FlagForge CVE-2025-61777

CRITICAL

Information Exposure (CWE-200)

2025-10-06 security-advisories@github.com

Information Disclosure Flagforge

9.1

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Discover unauthenticated admin API endpoint
Exploit

Send GET to enumerate badge templates and metadata
Execution

POST crafted badge templates to database
Impact

Data exposure and database pollution

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated HTTP requests against default configurations of FlagForge versions 2.0.0 through 2.3.1 reach the vulnerable /api/admin/badge-templates (GET) and /api/admin/badge-templates/create (POST) endpoints, which shipped with no authentication or role check. The only limiting factors are that the target must be running an affected pre-2.3.2 version and the attacker must know or guess the endpoint paths; no user interaction, credentials, or non-default settings are required. Impact is bounded to the badge-template subsystem (reading templates/metadata and creating template records), not the broader application.
Impact	Signals are mixed and point to a MODERATE real-world priority despite the CRITICAL 9.1 label. The CVSS vector (AV:N/AC:L/PR:N/UI:N) correctly captures that this is a remote, unauthenticated, trivial-to-reach broken-access-control flaw - the patched code confirms the GET/POST badge-template endpoints had literally no session or role check before v2.3.2. However, the C:H/I:H impact ratings appear inflated: the exposed data is badge templates plus low-sensitivity metadata (createdBy, createdAt, updatedAt), and the integrity impact is limited to creating/polluting badge-template records, not arbitrary code or credential/PII exposure. EPSS is low (0.45%, 37th percentile), there is no CISA KEV listing and no public exploit identified, which is consistent with a niche CTF platform rather than a mass-exploited target. Net: a genuine and easy-to-abuse access-control bug worth patching, but the 9.1 overstates business impact for most deployments - treat as a high-confidence-but-low-blast-radius issue rather than an emergency.
Exploit ScenarioDerived	An unauthenticated attacker sends a GET request to /api/admin/badge-templates and receives all badge templates plus internal metadata, then issues POST requests to /api/admin/badge-templates/create to inject arbitrary badge templates and pollute the database. No exploit code is publicly identified, but the attack requires only an HTTP client and knowledge of the endpoint path.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 09, 2026

Data exposure and unauthorized badge-template creation in FlagForge versions 2.0.0 through 2.3.1 allow remote unauthenticated attackers to retrieve all badge templates with createdBy/createdAt/updatedAt metadata and to insert arbitrary badge templates through the /api/admin/badge-templates GET and /api/admin/badge-templates/create POST endpoints. The flaw is CWE-200 and is fixed in FlagForge v2.3.2; no public exploit identified at time of analysis, and EPSS is 0.45% (37th percentile). Despite the supplied 9.1 CVSS, the independent assessment bounds impact to the badge-template subsystem with low confidentiality and integrity impact, making real-world priority moderate.

RemediationAI

Vendor-released patch: FlagForge 2.3.2. Upgrade to v2.3.2 or later; this adds authentication and Admin role checks to GET, POST, UPDATE, and DELETE badge-template endpoints as shown in commit e2121c5fb7a512a49dcd875812c944265fb1a846. The advisory is at https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-26rx-c53q-rjf9. No reliable workarounds are available; if immediate upgrade is impossible, restrict access to /api/admin/badge-templates and /api/admin/badge-templates/create at a reverse proxy or firewall so only trusted administrative networks can reach them, with the trade-off that legitimate badge-template management will be unavailable to remote admins until the path restriction is lifted.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

FlagForge is a Next.js/React CTF platform with API route handlers backed by MongoDB via Mongoose, and authentication handled by NextAuth. The vulnerable code in app/api/admin/badge-templates/route.ts lacked any getServerSession or role check before querying or writing BadgeTemplate records. The root cause is CWE-200 information exposure combined with missing authorization: the GET handler returned template documents including createdBy, createdAt, and updatedAt, while the POST handler accepted unauthenticated JSON to create templates with fields such as name, description, icon, color, and isActive. The patch introduces a requireAdmin helper that calls getServerSession, looks up the user in UserSchema, and returns 401 for unauthenticated users or 403 for non-Admin roles before proceeding on GET, POST, UPDATE, and DELETE. Affected CPE is cpe:2.3:a:flagforge:flagforge:*:*:*:*:*:*:*:* and the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, limiting impact to the badge-template subsystem rather than the whole application.

Know when Flagforge gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI 6.5 MEDIUM

Remote unauthenticated access (AV:N/AC:L/PR:N/UI:N) is confirmed by the patch, but exposed badge-template metadata and template creation are low-sensitivity, so C:L/I:L and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

DescriptionNVD

Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the /api/admin/badge-templates (GET) and /api/admin/badge-templates/create (POST) endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized users to retrieve all badge templates and sensitive metadata (createdBy, createdAt, updatedAt) and/or create arbitrary badge templates in the database. This could lead to data exposure, database pollution, or abuse of the badge system. The issue has been fixed in FlagForge v2.3.2. GET, POST, UPDATE, and DELETE endpoints now require authentication. Authorization checks ensure only admins can access and modify badge templates. No reliable workarounds are available.

Executive ViewAI

Why It Matters

FlagForge versions 2.0.0 through 2.3.1 leave the badge-template administration subsystem exposed, permitting retrieval of every badge template along with its creation and modification metadata and permitting insertion of arbitrary templates. Because FlagForge badges commonly underpin credentialing and access decisions, tampered or leaked templates can degrade trust in the credentials the organization issues and relies upon, affecting security, HR, and any team consuming badge data. A vendor fix exists in v2.3.2, and no public exploit has been identified at time of analysis, so leadership should treat this as a bounded but remediable exposure concentrated in the badge-template subsystem.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.5%

Top 63% exploitable

Prevalence

Rare

niche open-source CTF platform, minimal production enterprise footprint

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.