p PatchFirst

CVE-2026-29788

CVE-2026-29788 · TSPortal: Anyone can forge self-deletion requests of any user

This page contains facts from public vulnerability sources. Check the original advisory before updating.

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. This issue has been patched in version 30.

CVSS 8.4 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • tsportal

    Versions
    • < 30: Affected

    No fix published

  • miraheze/ts-portal Packagist

    Versions
    • v1
    • v10
    • v11
    • v12
    • v13
    • v14
    • v15
    • v16
    • v17
    • v18
    • v19
    • v2
    • v20
    • v21
    • v22
    • v23
    • v24
    • v25
    • v26
    • v27
    • v28
    • v29
    • v3
    • v4
    • v5
    • v6
    • v7
    • v8
    • v9
    Affected ranges
    • ECOSYSTEM: < 30

    Update to 30

Original sources

Check your server →