CVE-2026-29788CWE-1287CWE-283

TSPortal: Anyone can forge self-deletion requests of any user

High · published March 6, 2026

CVSS v4.0
8.4
EPSS
0%
Percentile
29.7
In the wild
Unconfirmed
What it is

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. This issue has been patched in version 30.

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H
EPSS
0.00370 · 29.7th percentile
Weaknesses
CWE-1287 · Improper Validation of Specified Type of Input; CWE-283 · Unverified Ownership
Published
2026-03-06T20:31Z
EPSS history
Timeline
  • 06 MAR 20:31Z
    TSPortal: Anyone can forge self-deletion requests of any user
    cvelistv5