TinaCMS CVE-2026-59992

Exploitation requires an active, authenticated CMS editor account (CVSS PR:L confirmed) within the TinaCMS deployment - anonymous or unauthenticated access is insufficient. The vulnerable code path is reached via standard media upload (GET with ?key=) and delete (DELETE with ?media=) HTTP requests to the Next.js API route that mounts createMediaHandler, which must be publicly reachable or reachable from the editor's network. The deployment must use at least one of the four affected adapter packages in a version prior to the fixed releases. Exploitation is limited to keys the deployment's storage credential can actually reach: if the IAM/service-principal policy is already scoped tightly to the mediaRoot prefix, the practical impact is contained even without patching. There is no requirement for a specific non-default configuration - any default TinaCMS deployment using these adapters with a broad storage credential is vulnerable.

The NVD-assigned CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) understates the practical impact: the I:L and A:L ratings assume limited scope, but the description explicitly states that an editor can reach 'other tenants' or non-media objects' throughout the entire bucket, which aligns more closely with I:H/A:H. The attack complexity is genuinely low once an editor account exists - no special tooling is required beyond crafting a query string. No EPSS data was provided and the vulnerability is not in CISA KEV, indicating no confirmed mass or active exploitation. No public proof-of-concept has been identified. The real-world risk is therefore moderate-to-high for any multi-tenant TinaCloud deployment or self-hosted deployment where the storage credential has broad bucket permissions, because a single compromised or malicious editor account can overwrite or purge arbitrary objects. Single-tenant deployments with tightly scoped IAM policies (bucket limited strictly to the media prefix) face substantially reduced blast radius. The scope change (S:U) in the provided vector is reasonable since impact stays within the same storage system, but organizations should treat this as high-priority given the potential for data destruction across an entire storage bucket.

A malicious authenticated CMS editor on a multi-tenant TinaCloud deployment crafts a DELETE request to the media handler with req.query.media set to an arbitrary S3 key such as 'other-tenant/config/production-settings.json' - a key that falls outside the editor's mediaRoot but within the deployment IAM credential's reach. The handler issues a DeleteObjectCommand for that exact key without validation, permanently removing the object. No public exploit code has been identified, but the attack requires nothing beyond a valid editor session and knowledge of target key names, making it trivially reproducible by any motivated editor.