PT-2026-28493 · Wikitide Foundation · Tsportal
Universal-Omega
·
Published
2026-03-26
·
Updated
2026-03-27
·
CVE-2026-33541
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
TSPortal versions prior to 34
Description
TSPortal, the WikiTide Foundation’s in-house platform used by the Trust and Safety team, was found to have a flaw that allowed attackers to create arbitrary user records in the database. This was possible due to abusing validation logic. While the validation process correctly rejected invalid usernames, a side effect within a validation rule caused user records to be created regardless of whether the request was successful. This could be exploited to cause uncontrolled database growth, potentially leading to a denial of service (DoS). The issue stemmed from performing state-changing operations (
User::findOrCreate()) inside validation logic and validation rules executing regardless of overall validation success. Specifically, when submitting a Data Processing Agreement (DPA) request, the DPAAlreadyLive validation rule called User::findOrCreate(), which created a user record if one did not already exist. This occurred even when the username validation (MirahezeUsernameRule) failed. An attacker could automate requests with invalid usernames, resulting in mass creation of arbitrary user records, unbounded database growth, increased storage and indexing overhead, and potential degradation of application performance.Recommendations
Versions prior to 34 should be updated to version 34 or later.
Exploit
Fix
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Tsportal