What is the CVSS score of EUVD-2026-10067?

EUVD-2026-10067 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Tsportal are affected by EUVD-2026-10067?

CVE-2026-29788 affects TSPortal, WikiTide Foundation's Trust and Safety platform, enabling attackers to forge deletion reports as legitimate user requests through empty string manipulation.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-10067?

Yes, a public proof-of-concept exploit is available for EUVD-2026-10067. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-10067?

Within 24 hours: disable TSPortal's report conversion feature or restrict access to the Trust and Safety team only; alert all TSPortal users of the vulnerability. Within 7 days: conduct forensic audit of all deletion reports processed since TSPortal v29 deployment to identify potentially forged requests; implement mandatory manual verification of all deletion reports before processing. Within 30 days: establish continuous monitoring for suspicious report patterns; coordinate with WikiTide Foundation for patched version timeline and plan upgrade immediately upon availability.

Tsportal EUVD-2026-10067

| CVE-2026-29788 HIGH

Unverified Ownership (CWE-283)

2026-03-06 security-advisories@github.com

GHSA-gfhq-7499-f3f2

Information Disclosure Tsportal

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 12, 2026 - 22:06 euvd

EUVD-2026-10067

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 11, 2026 - 14:00 vuln.today

Public exploit code

CVE Published

Mar 06, 2026 - 21:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. This issue has been patched in version 30.

AnalysisAI

TSPortal versions prior to 30 contain a logic flaw where empty strings are converted to null values, enabling attackers to forge Data Protection Act reports as legitimate user deletion requests. This affects the WikiTide Foundation's Trust and Safety platform and could allow misuse of the reporting system to obscure malicious activity. Public exploit code exists, and no patch is currently available for affected deployments.

Technical ContextAI

Affects Tsportal. TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. This issue has been patched in version 30.