TSPortal is a platform used by the WikiTide Foundation to handle reports, investigations, appeals, and transparency work. A flaw in validation logic before version 34 allows attackers to create arbitrary user records even when the username validation fails. This side effect causes uncontrolled growth of the user database, which can exhaust storage or other system resources and lead to a denial of service. The issue is identified as CWE‑400 (Information Saturation) and CWE‑770 (Allocation of Resources Without Limits).

The vulnerable product is Miraheze TSPortal. Versions earlier than 34 are affected. The fix is included in version 34 and later releases. No other products or vendors are listed.

The CVSS score of 6.5 indicates medium severity. An EPSS score of less than 1% implies a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The description does not specify whether authentication is required, so it cannot be said that any special privileges are needed or that an attacker must have user access. Based on the description, it is inferred that an attacker could trigger the bug by sending crafted requests to the user‑creation endpoint, but the exact method or required access is not detailed in the provided information.