{"id":"CVE-2026-29788","aliases":["GHSA-gfhq-7499-f3f2"],"url":"https://o3.security/vulnerability/CVE-2026-29788","summary":"TSPortal: Anyone can forge self-deletion requests of any user","details":"### Summary\nConversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports.\n\n### Details\nCreating a DPA report about another user and leaving the evidence field empty causes that report to look like the reported user self-requested deletion of their data. Ingenuine report is not distinguishable from a genuine one.\n\nThis can be prevented by disabling [convertEmptyStringsToNull](https://api.laravel.com/docs/12.x/Illuminate/Foundation/Configuration/Middleware.html#method_convertEmptyStringsToNull) in the middleware, or by validating `evidence` in Http/Controllers/DPAController::store() to not be empty.\n\n### PoC\nNew DPA report -> Select \"...someone who I suspect is under the age of 13\" for the \"The above username is...\" field -> Add nothing to the \"Evidence\" field -> Submit\n\n### Impact\nPotential unauthorized deletion of any arbitrary user's data both in the current system (TSPortal) and subsequent systems if actioned.","published":"2026-03-06T20:31:17.994Z","modified":"2026-09-18T03:30:45.769070463Z","cvss":null,"epss":{"score":0.00262,"percentile":0.1819,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"miraheze/ts-portal","fixedVersion":"30"}],"fix":null,"references":[{"type":"WEB","url":"https://issue-tracker.miraheze.org/T15053"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29788.json"},{"type":"ADVISORY","url":"https://github.com/miraheze/TSPortal/security/advisories/GHSA-gfhq-7499-f3f2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29788"},{"type":"WEB","url":"https://api.laravel.com/docs/12.x/Illuminate/Foundation/Configuration/Middleware.html#method_convertEmptyStringsToNull"},{"type":"PACKAGE","url":"https://github.com/miraheze/TSPortal"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-18T03:30:45.769070463Z"}}