Flag Forge Unauthenticated Resource Modification and Deletion Vulnerability

A broken access control vulnerability has been identified in Flag Forge versions 2.0.0 prior to 2.3.1. The issue resides in the /api/resources endpoint, which allowed POST and DELETE requests without proper authentication or authorization. This flaw could have enabled unauthorized users to create, modify, or delete resources on the platform, impacting the integrity of the data and the overall platform functionality.

Impact

Exploitation of this vulnerability could lead to unauthorized modification or deletion of resources, disrupting the integrity of the platform and its data.

Remediation

Users are advised to update Flag Forge to version 2.3.1 or later. The patched version requires authentication and validates user permissions before allowing POST or DELETE requests to modify resources.