Flag Forge Information Disclosure Vulnerability in User API Endpoint

A vulnerability in Flag Forge versions 2.0.0 prior to 2.3.1 allows the public API endpoint /api/user/[username] to expose user email addresses in its JSON response. This disclosure of personally identifiable information (PII) violates privacy expectations and could enable user enumeration. The issue has been resolved in Flag Forge version 2.3.1, which removes email addresses from public API responses while keeping the endpoint accessible.

Impact

Exploitation of this vulnerability leads to unauthorized exposure of user email addresses, allowing for enumeration of usernames and collection of personal information.

Remediation

Users are advised to upgrade to Flag Forge version 2.3.1 or later to address this vulnerability.