Read the docs
TI-2026-23374 Aliases CVE-2026-29788GHSA-gfhq-7499-f3f2

TSPortal: Anyone can forge self-deletion requests of any user

Priority LOW 36CWE-1287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. This issue has been patched in version 30.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00295 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed TSPortal (miraheze): 30miraheze/ts-portal (Packagist): 30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mirahezeTSPortalbefore 3030Patch availableCNA
—miraheze/ts-portal (Packagist)before 3030Patch availableGHSA-gfhq-7499-f3f2
  • TSPortal Vendormiraheze Affected before 30 Fixed in 30 Patch available CNA
  • miraheze/ts-portal (Packagist) Vendor— Affected before 30 Fixed in 30 Patch available GHSA-gfhq-7499-f3f2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wikitide:tsportal:*:*:*:*:*:*:*:*before 30VulnerableWikitide
  • cpe:2.3:a:wikitide:tsportal:*:*:*:*:*:*:*:* Versions before 30 Vulnerable ·Wikitide

Remediation

  • Fix · CNA TSPortal (miraheze) Fixed in 30
  • Fix · GHSA-gfhq-7499-f3f2 miraheze/ts-portal (Packagist) Fixed in 30 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-29788
  2. 2026-10-03 Alias added: GHSA-gfhq-7499-f3f2

References

Exploit 1

Advisory 1

Other 3

  • TI-2024-16562 Cross-Site Scripting in WikiDiscover CVSS 3.1MEDIUM 6.1
  • TI-2021-10196 wikiconfig API leaked private config variables set through ManageWiki CVSS 3.1CRITICAL 9.4
  • TI-2025-33333 DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLs CVSS 3.1CRITICAL 9.1
  • TI-2025-23966 ManageWiki has SQL injection vulnerability in NamespaceMigrationJob CVSS 3.1HIGH 8.0
  • TI-2024-32057 Cross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscover CVSS 3.1HIGH 7.6
  • TI-2022-08626 Authentication Bypass Using an Alternate Path or Channel in CreateWiki CVSS 3.1MEDIUM 5.3
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences