---
id: "CVE-2026-121562"
kind: "vulnerability"
aliases: ["CVE-2026-121562"]
title: "CTFd: unauthenticated teams API leaks hidden registration fields like emails"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ctfd", "other", "self-hosted", "team-mode"]
not_affected_if: ["default-config", "private-visibility"]
published_at: "2026-11-03T16:17:29+00:00"
first_seen_at: "2026-11-03T16:21:44+00:00"
updated_at: "2026-11-03T16:23:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121562", "first_seen_at": "2026-11-03T16:21:44+00:00"}]
---

# CTFd: unauthenticated teams API leaks hidden registration fields like emails

CTFd versions from 3.1.0 before 3.8.7 expose non-public team custom field values through the /api/v1/teams list endpoint. An unauthenticated attacker can page through GET requests to collect hidden registration data such as emails, phone numbers and student IDs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the CTFd version in use; the sources say versions from `3.1.0` before `3.8.7` are affected.
- Check whether team mode and public visibility are enabled, since the sources say the exposure needs both.

## Fix

- CTFd: upgrade to `3.8.7` or later.

## Timeline

- 2026-11-03T16:21:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121562

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ctfd-3.1.0-before-3.8.7-information-disclosure-via-api-v1-teams-endpoint
- [fix] Patch: github.com https://github.com/CTFd/CTFd/commit/122c224030224ca6a04d2928280055a84bbd4850
- [fix] Release notes: github.com https://github.com/CTFd/CTFd/releases/tag/3.8.7

## From the sources

CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_