EUVD-2026-81019Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network API, low complexity, attacker needs only their own low-privilege TinaCloud account (PR:L), no UI; grants full read (C:H), create/update (I:H) and delete (A:H) of victim content and media.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID and asks isUserAuthorized to validate the bearer token against that selected TinaCloud app instead of the self-hosted site's configured app. An attacker with any TinaCloud account can submit the attacker's own app ID and valid token to a victim endpoint, causing TinaCloudBackendAuthProvider or an affected media authorized callback to accept the attacker's verified status across the tenant boundary. The vulnerable logic is present in packages/@tinacms/auth/src/index.ts and packages/next-tinacms-azure/src/auth.ts. Successful exploitation permits media listing, reading, upload, or deletion and, when TinaCloudBackendAuthProvider is used, GraphQL read, create, update, and delete operations on the victim's content without a victim account or victim interaction. This vulnerability is fixed in @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1.
AnalysisAI
Cross-tenant authorization bypass in TinaCMS self-hosted deployments allows any holder of a legitimate TinaCloud account and its valid bearer token to read, create, update, delete, and manage media on a victim site without any victim account or interaction. The flaw affects @tinacms/auth before 1.1.4 and the next-tinacms-azure adapter before 15.0.1, where the server-side isAuthorized helper trusts a request-supplied clientID and therefore validates the attacker's token against the attacker's own TinaCloud app rather than the site's configured app (CWE-639, CVSS 8.8, PR:L). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid TinaCloud account (the attacker's own - any account suffices, PR:L) and a self-hosted Tina site that uses the vulnerable isAuthorized flow via TinaCloudBackendAuthProvider or the next-tinacms-azure media 'authorized' callback on versions @tinacms/auth < 1.1.4 or next-tinacms-azure < 15.0.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Multiple signals point to a genuine, elevated-priority authorization flaw rather than an inflated high-CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading to @tinacms/auth 1.1.4 and/or next-tinacms-azure 15.0.1 (or a later release) per advisory GHSA-g74q-6g2f-874x; the fix is upstream PR tinacms/tinacms#7168, commit 0a927a4f8d228dd05ee7ca4be32899bc190e73af, and tags @tinacms/auth@1.1.4 and next-tinacms-azure@15.0.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory self-hosted TinaCMS deployments to determine whether @tinacms/auth (versions before 1.1.4) or the next-tinacms-azure adapter (versions before 15.0.1) is in use, flag any instances as potentially tampered-with, restrict administrative and token access where feasible, and preserve content-change, media, and access logs for review. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in TinaCMS affects versions prior to 3.1.1, @tinacms/cli before 2.0.4, and @tinacms/graphql before
Cross-site request forgery in the TinaCMS CLI dev server allows an attacker-controlled web page to write arbitrary files
Broken access control across all four first-party TinaCMS production media adapters (next-tinacms-s3, next-tinacms-dos,
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today