Skip to content
Fencer Vulns
high 8.8

CVE-2026-63506 json

Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

published 2026-09-16 53 d ago modified 2026-09-30 39 d ago also EUVD-2026-81019 , GHSA-g74q-6g2f-874x

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID and asks isUserAuthorized to validate the bearer token against that selected TinaCloud app instead of the self-hosted site's configured app. An attacker with any TinaCloud account can submit the attacker's own app ID and valid token to a victim endpoint, causing TinaCloudBackendAuthProvider or an affected media authorized callback to accept the attacker's verified status across the tenant boundary. The vulnerable logic is present in packages/@tinacms/auth/src/index.ts and packages/next-tinacms-azure/src/auth.ts. Successful exploitation permits media listing, reading, upload, or deletion and, when TinaCloudBackendAuthProvider is used, GraphQL read, create, update, and delete operations on the victim's content without a victim account or victim interaction. This vulnerability is fixed in @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1.

Patch / fix

  • npm @tinacms/auth 1.1.4
  • npm next-tinacms-azure 15.0.1
  • ssw next-tinacms-azure 15.0.1
  • ssw next-tinacms-cloudinary 15.0.1
  • ssw next-tinacms-dos 15.0.1
  • ssw next-tinacms-s3 15.0.1
  • tina next-tinacms-azure 15.0.1
  • tina next-tinacms-cloudinary 15.0.1
  • tina next-tinacms-dos 15.0.1
  • tina next-tinacms-s3 15.0.1
  • tina tinacms 1.1.4, 15.0.1
  • ssw tinacms 1.1.4
  • ssw tinacms/cli 1.1.4
  • ssw tinacms/graphql 1.1.4
  • tina @tinacms/cli 1.1.4
  • tina @tinacms/graphql 1.1.4
  • tinacms cli 1.1.4
  • tinacms graphql 1.1.4

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
52 d ago

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/tinacms/tinacms/security/advisories/GHSA-g74q-6g2f-874x referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm @tinacms/auth
<1.1.4
1.1.4
npm next-tinacms-azure
<15.0.1
15.0.1

Affected products

  • tinacms tinacms
  • @tinacms auth
  • tinacms next-tinacms-azure

Classification

Weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.