CVE-2026-121562

EUVD-2026-115907
CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
ctfdctfd
3.1.0 ≤
𝑥
< 3.8.7
CNA
Common Weakness Enumeration
References
https://blog.ctfd.io/ctfd-3-8-7/
https://github.com/CTFd/CTFd
https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/api/v1/teams.py#L128-L131
https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/schemas/teams.py#L336-L363
https://github.com/CTFd/CTFd/commit/122c224030224ca6a04d2928280055a84bbd4850
https://github.com/CTFd/CTFd/releases/tag/3.8.7
https://www.vulncheck.com/advisories/ctfd-3.1.0-before-3.8.7-information-disclosure-via-api-v1-teams-endpoint