CVE-2024-11716

While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it's bracket and then pick a new one, joining another team while a competition is already ongoing. This issue impacts releases from 3.7.0 up to 3.7.4 and was addressed by pull request 2636 https://github.com/CTFd/CTFd/pull/2636  included in 3.7.5 release.

While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it's bracket and then pick a new one, joining another team while a competition is already ongoing. This issue impacts releases from 3.7.0 up to 3.7.4 and was addressed by pull request 2636 https://github.com/CTFd/CTFd/pull/2636  included in 3.7.5 release.

Si bien la asignación de un usuario a un equipo (grupo) en CTFd debería ser posible solo una vez, en el momento del registro, una falla en la implementación de la lógica permite que un usuario autenticado restablezca su grupo y luego elija uno nuevo, uniéndose a otro equipo mientras una competencia ya está en curso. Este problema afecta las versiones desde la 3.7.0 hasta la 3.7.4 y se solucionó mediante la solicitud de incorporación de cambios 2636 https://github.com/CTFd/CTFd/pull/2636 incluida en la versión 3.7.5.