EUVD-2026-115907Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate public CTFd in team mode
-
ExploitSend unauthenticated GET /api/v1/teams
-
ExecutionPaginate across all team records
-
ImpactHarvest hidden custom-field PII
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the CTFd instance to be deployed in team mode AND to have public visibility (public accounts/scoreboard) enabled, with teams having populated non-public custom registration fields; only then does the /api/v1/teams list endpoint leak those values to unauthenticated callers. Limiting factors: CTFd's default is user mode rather than team mode, and visibility must be set to public, so default or access-restricted deployments are not affected. Within those conditions no authentication, privileges, or user interaction are needed (PR:N/UI:N), and collection is trivially automatable via pagination. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw needing no privileges or user interaction, but impact is confidentiality-only and limited (VC:L; VI/VA:N), yielding a Medium 6.9. This is improper authorization (CWE-863), not a full authentication bypass: the /api/v1/teams list endpoint simply over-serializes non-public custom field values to unauthenticated callers. The vuln.today decision label is 'this_month' - a real but non-emergency priority. No EPSS score, no CISA KEV listing, and no confirmed public exploit were provided, so there is no signal of active or widespread exploitation; absence of EPSS/KEV is a data gap, not proof of safety. Net assessment: a credible, easily automatable PII-harvesting bug that matters for exposed public CTFd instances, but gated by specific deployment conditions (team mode + public visibility) rather than a drop-everything critical. The 'Authentication Bypass' tag overstates the mechanism; treat it as information disclosure via broken authorization. |
| Exploit ScenarioDerived | An attacker locates an internet-facing CTFd instance running in team mode with public visibility enabled and sends unauthenticated, paginated GET requests to /api/v1/teams. The responses include non-public team custom registration fields - such as emails, phone numbers, and student IDs - that should have been hidden, allowing bulk PII collection. No working public exploit is confirmed, though the vulnerable serialization lines and the fix commit are publicly referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Unauthenticated information disclosure in CTFd's /api/v1/teams list endpoint exposes non-public team custom registration fields - emails, phone numbers, student IDs - to anyone who paginates GET requests, but only on instances configured for team mode with public visibility enabled and teams that have populated hidden custom fields. Impact is confidentiality-only and limited (CVSS 4.0 6.9; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, Medium), with no integrity or availability effect. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, though harvesting is trivially automatable through pagination once the preconditions hold. A vendor patch exists in CTFd 3.8.7.
RemediationAI
Vendor-released patch: upgrade to CTFd 3.8.7, the first version containing the fix (commit 122c224030224ca6a04d2928280055a84bbd4850, https://github.com/CTFd/CTFd/commit/122c224030224ca6a04d2928280055a84bbd4850), available from https://github.com/CTFd/CTFd/releases/tag/3.8.7 with release notes at https://blog.ctfd.io/ctfd-3-8-7/; the vendor states a patch is available, so no fixed-version gap needs to be bridged. Where an immediate upgrade is not possible, reduce exposure by addressing the two preconditions the advisory names: disable public visibility for accounts/scoreboard or move the instance out of team mode, accepting the loss of public scoreboard and team functionality that those settings provide, and remove or stop collecting sensitive values (emails, phone numbers, student IDs) in team custom registration fields so that any residual serialization exposes nothing meaningful. Note that the change to schema view handling also emits deprecation warnings for code passing field lists instead of view names, which will be removed in CTFd 4.0 and should be tracked by anyone maintaining CTFd extensions or plugins.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CTFd is a Python/Flask capture-the-flag platform that serializes API responses through marshmallow schemas, where each schema exposes named 'views' controlling which fields are emitted for a given requester type. The flaw is a CWE-863 incorrect authorization / view-selection problem: the teams list handler deep-copied the TeamSchema view chosen for the requesting user type, removed only the 'members' field, and dumped team objects with that view, so fields defined as non-public in the team schema (emails, phone numbers, student IDs) were still serialized for unauthenticated callers when the deployment runs in team mode with public visibility. The upstream fix in commit 122c224030224ca6a04d2928280055a84bbd4850 replaces the copy-and-mutate pattern with an explicit TeamSchema(view=user_type, many=True, exclude=["members"]) (and TeamSchema(view=user_type) in the detail handler) and adds deprecation warnings across the schema classes for passing field lists instead of view names, slated for removal in CTFd 4.0. The CPE entry cpe:2.3:a:ctfd:ctfd:*:*:*:*:*:*:*:* is an unbounded wildcard, so version scoping comes from the advisory text - 3.1.0 through 3.8.6 - rather than from the CPE itself. Exploitation requires the configuration preconditions described in the advisory; the exact implementation path that leaks the fields is visible in the dangling source references to CTFd/api/v1/teams.py and CTFd/schemas/teams.py at tag 3.8.6.
Know when Ctfd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated remote endpoint with low complexity (PR:N/AV:N/AC:L); impact is limited confidentiality disclosure of custom fields (C:L), with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.
Threat Intelligence Overview
NVD
CVE.org
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the `#token=$ssid` has
Incorrect username validation in the registration process of CTFd v2.0.0 - v2.2.2 allows an attacker to take over an arb
Open redirect via safe-URL validator bypass in CTFd versions 3.8.0 through 3.8.3 allows remote unauthenticated attackers
Exploit-DB