{"id":"CVE-2026-121562","kind":"vulnerability","aliases":["CVE-2026-121562"],"related":[],"title":"CTFd: unauthenticated teams API leaks hidden registration fields like emails","description":"CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.","summary":"CTFd versions from 3.1.0 before 3.8.7 expose non-public team custom field values through the /api/v1/teams list endpoint. An unauthenticated attacker can page through GET requests to collect hidden registration data such as emails, phone numbers and student IDs.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ctfd","other","self-hosted","team-mode"],"not_affected_if":["default-config","private-visibility"],"how_to_check":"- Check the CTFd version in use; the sources say versions from `3.1.0` before `3.8.7` are affected.\n- Check whether team mode and public visibility are enabled, since the sources say the exposure needs both.","fix":"- CTFd: upgrade to `3.8.7` or later.","status":"open","published_at":"2026-11-03T16:17:29+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","triaged_at":"2026-11-03T16:23:56+00:00","updated_at":"2026-11-03T16:23:56+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-03T16:23:56Z","model":"claude-haiku-5-5","output":{"fix":"- CTFd: upgrade to `3.8.7` or later.","reach":"internet","title":"CTFd: unauthenticated teams API leaks hidden registration fields like emails","impact":"medium","summary":"CTFd versions from 3.1.0 before 3.8.7 expose non-public team custom field values through the /api/v1/teams list endpoint. An unauthenticated attacker can page through GET requests to collect hidden registration data such as emails, phone numbers and student IDs.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ctfd","self-hosted","team-mode"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"hidden registration data like emails and student IDs leaks","analyst_note":"","how_to_check":"- Check the CTFd version in use; the sources say versions from `3.1.0` before `3.8.7` are affected.\n- Check whether team mode and public visibility are enabled, since the sources say the exposure needs both.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","private-visibility"],"who_is_affected":"CTFd instances on versions from 3.1.0 before 3.8.7 with team mode and public visibility enabled. The sources say the exposure needs both settings; instances without team mode or with private visibility are not described as exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":4202,"output_tokens":505,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121562':13A,16A '-2026':12A,15A '/api/v1/teams':41B,76C '3.1.0':28B,66C '3.8.7':30B,68C 'api':4A 'attack':46B,89C 'collect':53B,95C 'contain':69C 'ctfd':1A,17B,25B,65C 'custom':36B,85C 'cve':11A,14A 'data':56B,98C 'disclosur':72C 'email':10A,59B,101C 'enabl':114C 'endpoint':43B,78C 'expos':31B,80C 'field':8A,37B,86C 'get':50B,92C 'hidden':6A,54B,96C 'host':21B 'id':64B,106C 'inform':71C 'leak':5A 'like':9A 'list':42B,77C 'mode':24B,109C 'non':33B,82C 'non-publ':32B,81C 'number':61B,103C 'page':48B 'pagin':91C 'phone':60B,102C 'public':34B,83C,111C 'registr':7A,55B,97C 'request':51B,93C 'self':20B 'self-host':19B 'student':63B,105C 'team':3A,23B,35B,84C,108C 'team-mod':22B 'unauthent':2A,45B,88C 'valu':38B,87C 'version':26B 'visibl':112C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"CTFd instances on versions from 3.1.0 before 3.8.7 with team mode and public visibility enabled. The sources say the exposure needs both settings; instances without team mode or with private visibility are not described as exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ctfd","medium","other","selfhosted","teammode"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121562","severity":null,"published_at":"2026-11-03T16:17:29+00:00","modified_at":"2026-11-03T16:17:29+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","fetched_at":"2026-11-03T16:21:44+00:00","note":null}],"documents":[{"id":58863,"url":"https://github.com/CTFd/CTFd/commit/122c224030224ca6a04d2928280055a84bbd4850","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58864,"url":"https://github.com/CTFd/CTFd/releases/tag/3.8.7","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":58865,"url":"https://www.vulncheck.com/advisories/ctfd-3.1.0-before-3.8.7-information-disclosure-via-api-v1-teams-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}