Threats tagged 'ghsa-qx4w-wvv4-8jv6'

CTFd versions from 3.1.0 up to but not including 3.8.7 have an information disclosure vulnerability in the /api/v1/teams list endpoint. This flaw allows unauthenticated attackers to paginate through team data and access non-public custom field values such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.