GHSA-gfhq-7499-f3f2

Source

https://github.com/advisories/GHSA-gfhq-7499-f3f2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-gfhq-7499-f3f2/GHSA-gfhq-7499-f3f2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gfhq-7499-f3f2

Aliases

CVE-2026-29788

Published

2026-03-27T15:37:10Z

Modified

2026-04-09T05:21:46Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
8.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H CVSS Calculator

Summary

TSPortal: Any user can forge self-deletion requests for any account

Details

Summary

Conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports.

Details

Creating a DPA report about another user and leaving the evidence field empty causes that report to look like the reported user self-requested deletion of their data. Ingenuine report is not distinguishable from a genuine one.

This can be prevented by disabling convertEmptyStringsToNull in the middleware, or by validating evidence in Http/Controllers/DPAController::store() to not be empty.

PoC

New DPA report -> Select "...someone who I suspect is under the age of 13" for the "The above username is..." field -> Add nothing to the "Evidence" field -> Submit

Impact

Potential unauthorized deletion of any arbitrary user's data both in the current system (TSPortal) and subsequent systems if actioned.

Database specific

{
    "cwe_ids":  [
        "CWE-1287",
        "CWE-283"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-27T15:37:10Z",
    "nvd_published_at":  "2026-03-06T21:16:15Z",
    "severity":  "HIGH"
}

References

Affected packages

Packagist / miraheze/ts-portal

Package

Name: miraheze/ts-portal
Purl: pkg:composer/miraheze/ts-portal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

30

Affected versions

Other

v10

v11

v12

v13

v14

v15

v16

v17

v18

v19

v20

v21

v22

v23

v24

v25

v26

v27

v28

v29

Database specific

last_known_affected_version_range

"<= 29"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-gfhq-7499-f3f2/GHSA-gfhq-7499-f3f2.json"