TSPortal, used by the WikiTide Foundation’s Trust and Safety team, had a vulnerability in versions before 34 where a validation rule side effect caused user records to be created regardless of validation success. Although invalid usernames were rejected, the flawed logic allowed attackers to create arbitrary user entries, leading to uncontrolled database growth. This resource exhaustion could result in a denial of service condition. The issue is tracked as CVE-2026-33541 with a CVSS 3.1 score of 6.5 (medium severity). Version 34 of TSPortal includes a fix that addresses this problem.

The vulnerability allows attackers with at least low privileges to cause uncontrolled growth of the user database by creating arbitrary user records. This can lead to denial of service due to resource exhaustion on the affected system. There is no impact on confidentiality or integrity reported. No known exploits are currently observed in the wild.

Upgrade TSPortal to version 34 or later, where the vulnerability has been fixed. Since this is an on-premises product, administrators should apply the official update to prevent exploitation. Patch status is confirmed by the vendor stating version 34 contains the fix.