Officials relaxed rules for Wednesday’s final, which Lokomotiv won 5-3 on penalties, by increasing the number of fans allowed into the stadium from 4,000 to 12,000.
CNN has contacted the Bulgarian FA, CSKA Sofia and Lokomotiv Plovdiv for comment but did not immediately receive a response.
The match ended 0-0 after extra-time, but a 100% conversion rate from the penalty spot saw Lokomotiv retain the Cup and secure a place in the qualifying rounds of the Europa League.
CSKA head coach Milos Kruscic stood down after the game.
Wednesday’s final raises further questions about hosting football matches with fans in attendance.
Bulgaria’s Sports Minister Krasen Kralev reportedly said that violations during Wednesday game could lead to “more drastic measures” being implemented.
Balkan countries, which have seen less severe outbreaks of the coronavirus compared to other European nations, have opened up sporting events comparatively quickly.
The Adria Tour was widely criticized after a number of top players, including Djokovic, tested positive for coronavirus having played in the competition’s second event in Zadar, Croatia.
Fixtures in the UK, Germany, Italy and Spain have all taken place behind closed doors, while other European countries have allowed some fans back.
In Denmark, for example, a limited number spectators have been permitted into stadiums while observing social distancing.
It resulted in a spike in popularity, with the country’s football federation securing new broadcasting deals in as many as 10 countries.