CVE-2026-121562
CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.
| CWE | CWE-863 |
| Vendor | ctfd |
| Product | ctfd |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for ctfd ctfd
Be the first to know when new medium vulnerabilities affecting ctfd ctfd are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
CTFd / CTFd
3.1.0 < 3.8.7
References
github.com: https://github.com/CTFd/CTFd/commit/122c224030224ca6a04d2928280055a84bbd4850 github.com: https://github.com/CTFd/CTFd github.com: https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/api/v1/teams.py#L128-L131 github.com: https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/schemas/teams.py#L336-L363 blog.ctfd.io: https://blog.ctfd.io/ctfd-3-8-7/ github.com: https://github.com/CTFd/CTFd/releases/tag/3.8.7 vulncheck.com: https://www.vulncheck.com/advisories/ctfd-3.1.0-before-3.8.7-information-disclosure-via-api-v1-teams-endpoint
Credits
Oceanwarranty (ASK PENTEST SDN. BHD.) ColdHeat