EUVD-2026-10067
GHSA-gfhq-7499-f3f2
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
5Description
TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. This issue has been patched in version 30.
Analysis
TSPortal versions prior to 30 contain a logic flaw where empty strings are converted to null values, enabling attackers to forge Data Protection Act reports as legitimate user deletion requests. This affects the WikiTide Foundation's Trust and Safety platform and could allow misuse of the reporting system to obscure malicious activity. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: disable TSPortal's report conversion feature or restrict access to the Trust and Safety team only; alert all TSPortal users of the vulnerability. Within 7 days: conduct forensic audit of all deletion reports processed since TSPortal v29 deployment to identify potentially forged requests; implement mandatory manual verification of all deletion reports before processing. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today