Is CVE-2025-59843 actively exploited?

No active exploitation of CVE-2025-59843 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-59843 be exploited remotely?

Yes. CVE-2025-59843 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-59843?

CVE-2025-59843 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2025-59843

MEDIUM

CVE-2025-59843

CWE-359Published: September 26, 2025· Updated: Jun 17, 2026

5.3

CVSS v3.1

Official Description

Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public API responses while keeping the endpoint publicly accessible. Users should upgrade to version 2.3.2 or later to eliminate exposure. There are no workarounds for this vulnerability.

NVD Source

Technical Analysis

CVE-2025-59843 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.