Live › vulnerability › CVE-2026-121562
CTFd versions from 3.1.0 before 3.8.7 expose non-public team custom field values through the /api/v1/teams list endpoint. An unauthenticated attacker can page through GET requests to collect hidden registration data such as emails, phone numbers and student IDs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
CTFd instances on versions from 3.1.0 before 3.8.7 with team mode and public visibility enabled. The sources say the exposure needs both settings; instances without team mode or with private visibility are not described as exposed.
No product ranges from the sources yet.
3.1.0 before 3.8.7 are affected.3.8.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-121562")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.