CVE-2026-121562

    Dashboard / Vulnerabilities / CVE-2026-121562

    CVE-2026-121562

    Published: 3 Nov 2026Last Modified: 5 Nov 2026

    Summary: CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint

    Details: CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.

    References: https://github.com/CTFd/CTFd/releases/tag/3.8.7, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121562.json, https://nvd.nist.gov/vuln/detail/CVE-2026-121562, https://www.vulncheck.com/advisories/ctfd-3.1.0-before-3.8.7-information-disclosure-via-api-v1-teams-endpoint, https://github.com/CTFd/CTFd/commit/122c224030224ca6a04d2928280055a84bbd4850, https://github.com/CTFd/CTFd, https://blog.ctfd.io/ctfd-3-8-7/, https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/api/v1/teams.py#L128-L131, https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/schemas/teams.py#L336-L363

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- cfde6c99afa8745ffeed15d0824554e7b6269dd0
    Fixed -ba53a21e53d1580f75e5186221563e030b839434

    Affected versions

    3.8.6
    3.8.5
    3.8.4
    3.8.3
    3.8.2
    3.8.1
    3.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-121562 | CVE-DB