FlagForgeCTF flagForge up to 2.3.2 API Endpoint /api/user/ Username redos

Summaryinfo

A vulnerability has been found in FlagForgeCTF flagForge up to 2.3.2 and classified as problematic. This affects an unknown function of the file /api/user/ of the component API Endpoint. The manipulation of the argument Username leads to redos. This vulnerability is uniquely identified as CVE-2026-21868. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in FlagForgeCTF flagForge up to 2.3.2 and classified as problematic. This issue affects an unknown part of the file /api/user/ of the component API Endpoint. The manipulation of the argument username with an unknown input leads to a redos vulnerability. Using CWE to declare the problem leads to CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. Impacted is availability. The summary by CVE is:

Flag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint (/api/user/[username]). The application constructs a regular expression dynamically using unescaped user input (the username parameter). An attacker can exploit this by sending a specially crafted username containing regex meta-characters (e.g., deeply nested groups or quantifiers), causing the MongoDB regex engine to consume excessive CPU resources. This can lead to Denial of Service for other users. The issue is fixed in version 2.3.3. To workaround this issue, implement a Web Application Firewall (WAF) rule to block requests containing regex meta-characters in the URL path.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-21868 since 01/05/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1449.003 according to MITRE ATT&CK.

Upgrading to version 2.3.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CNNVD (CNNVD-202601-1576). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• FlagForgeCTF

Name

• flagForge

Version

• 2.3.0
• 2.3.1
• 2.3.2

Website

• Product: https://github.com/FlagForgeCTF/flagForge/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion