A critical logic flaw in Flag Forge versions 2.1.0 through 2.2.x allows unauthenticated users to bypass challenge requirements and access sensitive hint data.

The API endpoint GET /api/problems/:id fails to verify if a user has performed the necessary point deduction before returning challenge hints. This allows any unauthenticated actor to retrieve hint data in plaintext directly from the application.

The exploitation of this vulnerability undermines the core integrity of the Capture The Flag platform by allowing unauthorized access to restricted challenge data. This results in the degradation of the competition environment, potential loss of user trust, and total failure of the intended game logic. While the CVSS score is 7.5, the impact is significant for organizations relying on this platform for secure training or competitive events.

Immediate Action: Update the Flag Forge platform to version 2.3.0 or later to ensure proper authorization checks are enforced on all API endpoints.

Proactive Monitoring: Review application access logs for unusual patterns of GET requests to the /api/problems/ endpoint, particularly those originating from unauthenticated sessions.

Compensating Controls: Implement rate limiting or WAF rules to restrict access to the /api/problems/ directory if an immediate upgrade is not feasible, though these are secondary to patching.

Public Exploit Available: Unknown

The vulnerability represents a significant risk to the integrity of the Flag Forge platform. Administrators are strongly advised to verify their current version and apply the 2.3.0 patch immediately. Failure to remediate will allow continued unauthorized access to challenge information, effectively nullifying the competitive nature of the platform.