MEDIUM 6.9 NVD
CVE-2026-121562
CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Un
CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.
References
- https://blog.ctfd.io/ctfd-3-8-7/
- https://github.com/CTFd/CTFd
- https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/api/v1/teams.py#L128-L131
- https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/schemas/teams.py#L336-L363
- https://github.com/CTFd/CTFd/commit/122c224030224ca6a04d2928280055a84bbd4850
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-11-03 via NVD.
vulnfeed aggregates 18261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.