High severity · published Mar 6, 2026
CVE-2026-29788
TSPortal: Anyone can forge self-deletion requests of any user
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. This issue has been patched in version 30.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
TSPortal · miraheze
< 30 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-29788
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-29788
Exploit
https://github.com/miraheze/TSPortal/security/advisories/GHSA-gfhq-7499-f3f2
Issue Tracking
https://issue-tracker.miraheze.org/T15053
More from TSPortal
6.5
CVE-2026-33541
TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service