CTFd 3.8.7 has been released with fixed for the following security vulnerabilities:
- Fixed an issue where where the REST API would return the values of Custom Fields despite the field not being set to public
- Fixed an issue where max attempts on a challenge could sometimes be bypassed allowing a user to get more attempts than they should
We recommend all CTFd users update their instance to v3.8.7.
v3.8.7 has already been deployed to Hosted CTFd customers. Self-hosted users can download the latest version of CTFd from Github or by downloading the latest version of the Enterprise installer from their account at https://cloud.ctfd.io/.