CTFd — The Cyber Toolchain

CTFd v1

Mon, 26 Oct 2026 13:48:20 GMT

API surface changed: 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • GET /unlocks: param ip (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ctfd

CTFd v1

Tue, 04 Aug 2026 11:21:39 GMT

API surface changed: +18 endpoints, 4 modified • New endpoint DELETE /audiences/{audience_id} • New endpoint DELETE /audiences/{audience_id}/members/{member_id} • New endpoint DELETE /modules/{module_id} • New endpoint DELETE /modules/{module_id}/audiences/{audience_id} • New endpoint GET /audiences • New endpoint GET /audiences/{audience_id} • New endpoint GET /audiences/{audience_id}/members • New endpoint GET /modules • New endpoint GET /modules/{module_id} • New endpoint GET /modules/{module_id}/audiences • New endpoint GET /modules/{module_id}/challenges • New endpoint PATCH /audiences/{audience_id} • New endpoint PATCH /modules/{module_id} • New endpoint POST /audiences • New endpoint POST /audiences/{audience_id}/members • New endpoint POST /modules • New endpoint POST /modules/{module_id}/audiences • New endpoint POST /modules/{module_id}/challenges • GET /challenges: response schema changed • GET /challenges/{challenge_id}: response schema changed • PATCH /challenges/{challenge_id}: response schema changed • POST /challenges: response schema changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ctfd

CTFd 3.8.6

Tue, 16 Jun 2026 20:20:19 GMT

CTFd 3.8.6 lets admins retroactively mark correct submissions as incorrect via UI and API. • New Admin Panel UI to mark a previously correct submission as incorrect. • Supports `PATCH /api/v1/submissions/[submission_id]` to programmatically mark submissions as incorrect. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ctfd

CTFd 3.8.6

Tue, 16 Jun 2026 20:20:19 GMT

CTFd 3.8.6 adds admin UI and API support for reclassifying correct submissions as incorrect. • New Admin Panel UI to mark a previously correct submission as incorrect. • PATCH /api/v1/submissions/[submission_id] now supports marking submissions as incorrect via the API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ctfd

CTFd 3.8.5

Tue, 19 May 2026 15:52:49 GMT

CTFd 3.8.5 adds Indonesian translations • Adds Indonesian language translations to the platform. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ctfd

CTFd 3.8.3

Sat, 11 Apr 2026 03:23:45 GMT

CTFd 3.8.3 adds challenge positioning, localized datetimes, new progression matrix API, and Serbian/Czech translations. • Adds Challenge Position field to control explicit ordering of challenges (1–n, with 0 falling to the end). • Supports localized datetime formatting so dates display in each user's preferred language format. • Adds anonymize setting to preview general details of challenges that have prerequisites. • Updates progression matrix with browser-stored filters and a new challenge category column. • Adds separate frozen and unfrozen scoreboard CSV exports (unfrozen available as `scoreboard-admin` CSV). • Adds CSV import & export for users that includes their team information. • New `/api/v1/statistics/progression/matrix` endpoint backing the progression matrix view. • Adds response caching to `/api/v1/users/[user_id]` and `/api/v1/teams/[team_id]`. • Returns a description field in 401 error responses from the API. • Adds Serbian and Czech translations. • When restoring from a backup, automatically applies the theme from the backup if available, falling back to the default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ctfd

CTFd 3.8.2

Thu, 05 Feb 2026 20:42:06 GMT

CTFd 3.8.2 adds ratelimit submission tracking, new plugin APIs, Norwegian/Turkish/Croatian translations, and a rootless Docker Compose default. • Adds `ratelimit` submission type so rate-limited attempts are tracked separately from `incorrect` submissions. • Adds `Ratelimiteds` submission class and BaseChallenge.ratelimited() method for plugin developers to create rate-limited submission records. • Adds `force_all` parameter to CTFd.plugins.migrations.upgrade() enabling plugins to force-run all migrations. • Adds `app.overridden_functions` global allowing plugins to override supported platform functions. • Raises `ChallengeSolveException` in BaseChallenge.solve() when a duplicate solve is encountered, giving plugins a consistent signal to handle. • Adds `PUT` method to IP address tracking endpoint. • Required fields in registration, login, and custom field forms are now marked with a red asterisk. • Adds Norwegian, Turkish, and Croatian translations. • Docker Compose deployment now runs as the `ctfd` user instead of `root`. Breaking changes: • The provided Docker Compose file no longer uses the `root` user and instead uses the `ctfd` user — file permission mappings tied to `root` in existing deployments may break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ctfd

CTFd 3.8.1

Thu, 06 Nov 2025 21:02:37 GMT

CTFd 3.8.1 integrates dynamic scoring into standard challenges and adds solution-access controls with new API endpoints. • Integrates dynamic scoring into the standard challenge type — all challenges now support `initial`, `decay`, `minimum`, and `function` fields for configurable scoring logic, removing the need for a separate plugin. • Adds `solved` solution visibility mode, letting users view a challenge's solution only after they have solved it. • Adds bulk editing for solution visibility on the Admin Panel Challenges page. • New `/api/v1/challenges/[challenge_id]/solution` endpoint to check whether a challenge solution is accessible to the requesting user. • Changes `GET /api/v1/solutions/[solution_id]` to return 404 instead of 403 for hidden solutions. • New `RUN_ID` config option specifies a token used as a cache-buster URL parameter. • New `EXTRA_CONFIGS_FORCE_TYPES` config allows server admins to enforce types for values in the `[extra]` config section. • Adds Uzbek and Hebrew language translations. • CTFd.js bumped to `0.0.19`, adding `getSolutionState` and `setSolutionId` functions for theme developers to determine solution accessibility. Breaking changes: • `GET /api/v1/solutions/[solution_id]` now returns 404 (not 403) when a solution is hidden — clients that branch on 403 to detect hidden solutions will need to be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ctfd

CTFd 3.8.0

Thu, 04 Sep 2025 22:35:46 GMT

CTFd 3.8.0 adds challenge ratings, multi-flag logic, solution storage, bracket scoreboards, and automated deployment presets. • Adds configurable visibility for users' own past submissions via new `/api/v1/users/me/submissions` endpoint and admin toggle. • Admins can now store and publish challenge solutions, accessible to users via `/api/v1/challenges/[challenge_id]/solutions` and unlocked through `/api/v1/unlocks`. • New challenge `logic` field lets developers require any single flag (`any`), all flags (`all`), or a flag from every team member (`team`) before a solve is counted. • Max Attempts can now act as a timed cooldown (e.g., 5-minute lockout) rather than a permanent lockout. • Participants can submit upvotes/downvotes and written reviews on challenges via `/api/v1/challenges/[challenge_id]/ratings`; visibility is admin-configurable. • Hints now require an explicit unlock action even when free, improving accidental-view prevention and hint-usage tracking. • Hints can now be given a title shown to users before they unlock the hint. • CTFd logs a `challenges.open` tracking event in the Tracking table the first time a user opens a challenge. • Adds a matrix scoreboard to the Admin Panel Statistics page to visualise player progression through challenges. • Admin Panel scoreboard now supports brackets. • New admin config option for minimum password length. • Admins can now force users to change their password on next login via the `change_password` field on `/api/v1/users/[user_id]`. • New `PRESET_ADMIN_NAME`, `PRESET_ADMIN_EMAIL`, `PRESET_ADMIN_PASSWORD`, and `PRESET_ADMIN_TOKEN` keys in `config.ini` for pre-creating an admin account in automated deployments. • New `PRESET_CONFIGS` key in `config.ini` allows pre-setting server-side configuration without completing the setup wizard or using the API. • New `EMAIL_CONFIRMATION_REQUIRE_INTERACTION` key in `config.ini` requires additional user interaction on confirmation links to improve anti-phishing compatibility. • Adds `BaseChallenge.partial` for plugin authors to indicate partial solves used with `all`-logic challenges. • The `core-beta` theme is promoted to `core`; the previous `core` theme is renamed `core-deprecated`. Breaking changes: • Challenge Type Plugins must now return a `ChallengeResponse` object instead of a (status, message) tuple (legacy tuple behavior is supported until CTFd 4.0). • The `core-beta` theme is renamed to `core`; the previous `core` theme is renamed `core-deprecated` — any theme references to `core` or `core-beta` in deployments will resolve to different themes after upgrade. • `pybluemonday` is replaced with `nh3` for HTML sanitisation — any plugin or deployment that depends directly on `pybluemonday` will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ctfd

CTFd 3.7.7

Tue, 15 Apr 2025 05:19:23 GMT

CTFd 3.7.7 adds email domain denylisting, titled hints, and SHA1 sums for challenge files. • Adds ability to denylist/blacklist email domains from registering, blocking unwanted participants at sign-up. • Hints can now include an optional title shown to users before they unlock the hint. • Challenge files in the Admin Panel now display their stored SHA1 checksum for integrity verification. • The `/api/v1/scoreboard/top/` endpoint now enforces a maximum return of top 50 accounts. Breaking changes: • The `/api/v1/scoreboard/top/` endpoint now returns at most the top 50 accounts; requests for counts above 50 will be capped. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ctfd

CTFd 3.7.6

Thu, 20 Feb 2025 04:34:40 GMT

CTFd 3.7.6 adds trusted host restrictions, a language switcher, new locales, and richer plugin APIs. • Adds `TRUSTED_HOSTS` configuration to restrict CTFd to allowlisted host names, hardening against host-header attacks. • New language switcher in the main navigation bar lets users change the UI language without admin intervention. • Adds Romanian, Greek, Finnish, Slovenian, and Swedish translations. • Challenge type plugins can now raise `ChallengeCreateException` or `ChallengeUpdateException` to surface input validation messages to users. • Plugins that specify a config route now automatically appear in the Admin Panel under the Plugins section. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ctfd

CTFd 3.7.5

Sat, 28 Dec 2024 01:44:02 GMT

CTFd 3.7.5 adds a category point breakdown graph, bracket data in CSV exports, and language selection in the nav bar. • Adds a point breakdown graph in the Admin Panel showing challenge points allocated per category. • Adds Bracket ID and Bracket Name columns to CSV scoreboard exports. • Adds language selection to the main theme navigation bar. • Supports setting a password without requiring a previous password confirmation when a user or team has no password set. • Splits `/api/v1/flags/types` and `/api/v1/flags/types/` into two separate controllers. • Improves IP tracking performance by only recording IPs not previously seen or on state-changing methods. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ctfd

CTFd 3.7.4

Wed, 09 Oct 2024 03:51:13 GMT

CTFd 3.7.4 adds challenge attribution fields, bracket display, dark mode, and customizable ECharts graph options. • Adds an attribution field to Challenges for crediting challenge authors or sources. • Displays brackets in the Admin Panel and on user/team listing and profile pages. • Adds dark mode to the core-beta theme. • Enables overriding ECharts scoreboard and score-graph behavior via `window.scoreboardChartOptions`, `window.teamScoreGraphChartOptions`, and `window.userScoreGraphChartOptions` window objects. • Adds `type` and `extra` arguments to Assets.js() with `defer` defaulting to `False`. • Updates the scoreboard score graph to reflect the currently active bracket. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ctfd

CTFd 3.7.3

Wed, 24 Jul 2024 21:00:44 GMT

CTFd 3.7.3 adds admin-configurable default language and a new Catalan translation. • Adds a Localization section to the Admin Config Panel for managing language settings. • New Default Language config option lets admins set a platform-wide language instead of relying on each user's browser auto-detection. • Adds Catalan as a supported translation language. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ctfd

CTFd 3.7.2

Tue, 18 Jun 2024 00:00:00 GMT

CTFd 3.7.2 adds CORS policy configuration and changes pagination API responses • Adds `CROSS_ORIGIN_OPENER_POLICY` setting to control the `Cross-Origin-Opener-Policy` header • Listing pages now return HTTP 200 with empty listings instead of 404 when no items are found Breaking changes: • API endpoints returning pagination results now return HTTP 200 with an empty list body on failure instead of HTTP 404, which may break clients expecting a 404 status code for empty/not found states. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ctfd

CTFd 3.7.1

Sat, 01 Jun 2024 07:03:04 GMT

CTFd 3.7.1 adds raw export API, debug endpoint, plugin config templates, and defer support in Assets.js • Adds `serializeJSON` function back into the Admin Panel • Adds `/api/v1/exports/raw` API endpoint to allow for exports to be generated via the API • Adds a query parameter to ScoreboardDetail endpoint (`/api/v1/scoreboard/top/`) to filter by bracket • Return `function` field for DynamicValue challenges data read • Add `defer` parameter to Assets.js() to allow controlling the defer attribute of inserted `