TI-2026-42776 Aliases CVE-2026-59992 GHSA-8mq9-5fw2-5rm4

Authorization bypass in tinacms

MEDIUM 58CWE-639Published 2026-08-19 · Updated 2026-08-21

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without enforcing the operator's configured mediaRoot. In packages/next-tinacms-s3/src/handlers.ts, createMediaHandler accepts req.query.key for a signed PutObject URL and the DELETE path uses req.query.media as the DeleteObjectCommand key. The same missing key-boundary check exists in packages/next-tinacms-dos/src/handlers.ts, packages/next-tinacms-azure/src/handlers.ts, and packages/next-tinacms-cloudinary/src/handlers.ts. An authenticated CMS editor can therefore create or delete objects anywhere the deployment's storage credential can reach, including other tenants' or non-media objects. These issues are fixed in next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0038 32nd percentileScored 2026-11-07

Fix Fixed tinacms (tinacms): 23.0.4next-tinacms-s3 (tinacms): 23.0.4+7 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
tinacms	tinacms	before 23.0.4	23.0.4	Patch available	CNA
tinacms	next-tinacms-s3	before 23.0.4	23.0.4	Patch available	CNA
tinacms	next-tinacms-dos	before 23.0.4	23.0.4	Patch available	CNA
tinacms	next-tinacms-azure	before 14.0.4	14.0.4	Patch available	CNA
tinacms	next-tinacms-cloudinary	before 26.0.4	26.0.4	Patch available	CNA
—	next-tinacms-s3 (npm)	before 23.0.4	23.0.4	Patch available	GHSA-8mq9-5fw2-5rm4
—	next-tinacms-dos (npm)	before 23.0.4	23.0.4	Patch available	GHSA-8mq9-5fw2-5rm4
—	next-tinacms-azure (npm)	before 14.0.4	14.0.4	Patch available	GHSA-8mq9-5fw2-5rm4
—	next-tinacms-cloudinary (npm)	before 26.0.4	26.0.4	Patch available	GHSA-8mq9-5fw2-5rm4

tinacms Vendortinacms Affected before 23.0.4 Fixed in 23.0.4 Patch available CNA
next-tinacms-s3 Vendortinacms Affected before 23.0.4 Fixed in 23.0.4 Patch available CNA
next-tinacms-dos Vendortinacms Affected before 23.0.4 Fixed in 23.0.4 Patch available CNA
next-tinacms-azure Vendortinacms Affected before 14.0.4 Fixed in 14.0.4 Patch available CNA
next-tinacms-cloudinary Vendortinacms Affected before 26.0.4 Fixed in 26.0.4 Patch available CNA
next-tinacms-s3 (npm) Vendor— Affected before 23.0.4 Fixed in 23.0.4 Patch available GHSA-8mq9-5fw2-5rm4
next-tinacms-dos (npm) Vendor— Affected before 23.0.4 Fixed in 23.0.4 Patch available GHSA-8mq9-5fw2-5rm4
next-tinacms-azure (npm) Vendor— Affected before 14.0.4 Fixed in 14.0.4 Patch available GHSA-8mq9-5fw2-5rm4
next-tinacms-cloudinary (npm) Vendor— Affected before 26.0.4 Fixed in 26.0.4 Patch available GHSA-8mq9-5fw2-5rm4

Remediation

Fix · CNA tinacms (tinacms) Fixed in 23.0.4
Fix · CNA next-tinacms-s3 (tinacms) Fixed in 23.0.4
Fix · CNA next-tinacms-dos (tinacms) Fixed in 23.0.4
Fix · CNA next-tinacms-azure (tinacms) Fixed in 14.0.4
Fix · CNA next-tinacms-cloudinary (tinacms) Fixed in 26.0.4
Fix · GHSA-8mq9-5fw2-5rm4 next-tinacms-s3 (npm) Fixed in 23.0.4 Advisory →
Fix · GHSA-8mq9-5fw2-5rm4 next-tinacms-dos (npm) Fixed in 23.0.4 Advisory →
Fix · GHSA-8mq9-5fw2-5rm4 next-tinacms-azure (npm) Fixed in 14.0.4 Advisory →
Fix · GHSA-8mq9-5fw2-5rm4 next-tinacms-cloudinary (npm) Fixed in 26.0.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-59992
2026-10-03 Alias added: GHSA-8mq9-5fw2-5rm4

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-59992

Other 5

TI-2026-22987 Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS CVSS 3.1CRITICAL 9.7
TI-2026-70295 TinaCMS admin preview frames attacker-controlled origin CVSS 3.1CRITICAL 9.3
TI-2026-45239 Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site CVSS 3.1HIGH 8.8
TI-2026-26851 @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions CVSS 3.1HIGH 8.8
TI-2026-22988 Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS CVSS 3.1HIGH 8.4
TI-2026-70293 Code injection in Tina CLI via unescaped Git branch name CVSS 3.1HIGH 8.2

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences