A flaw in TSPortal’s validation logic lets attackers trigger a side effect that creates user records in the database even when a username fails validation. The rule that accepts invalid usernames and its side effect results in uncontrolled database growth, which is a classic denial of service scenario. The weakness corresponds to CWE‑400, Denial of Service, and CWE‑770, Uncontrolled Resource Consumption.

The vulnerability affects TSPortal deployments that use versions prior to 34. The application is run by the WikiTide Foundation’s Trust and Safety team to handle reports, appeals, and transparency work. The issue was fixed in version 34.

The CVSS score of 6.5 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not a known exploited vulnerability yet. An attacker can likely exploit the flaw from an unauthenticated request; no special privileges are required, and the side effect will occur regardless of the request outcome, making the attack path straightforward.