CVE-2026-108261
CriticalCVSS 9.3Summary
In versions prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in Tina (a headless CMS) can turn an attacker-controlled hash-router splat into an off-origin iframe URL, while expectedOrigin for the GraphQL message channel is derived from that same URL. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview, allowing GraphQL reads or mutations with the editor's credentials. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.
Risk Assessment
An attacker can access or modify protected content using the editor's session, potentially leading to confidentiality and integrity breaches.
Recommendation
Update Tina to version tinacms 3.14.0 and @tinacms/app 2.5.14 or later to prevent embedding malicious iframes.
Other vulnerabilities in Tina
See all- CVE-2026-108260High
Tina (headless CMS) versions prior to 0.2.1 assign a rich-text node.url value directly to an anchor href without validating the URL scheme in the tina-markdown element. A content author can store a link using a script-capable scheme, and a visitor clicking the rendered link executes attacker-controlled script in the site's origin. The issue is fixed in version 0.2.1.
- CVE-2026-108259High
Tina (headless CMS) versions prior to 3.0.0 — @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD and interpolates the raw value into the API URL and JavaScript string literals in generated code. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The issue is fixed in version 3.0.0.
- CVE-2026-63506High
Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID and asks isUserAuthorized to validate the bearer token against that selected TinaCloud app instead of the self-hosted site's configured app. An attacker with any TinaCloud account can submit the attacker's own app ID and valid token to a victim endpoint, causing TinaCloudBackendAuthProvider or an affected media authorized callback to accept the attacker's verified status across the tenant boundary.
Original NVD description (English source)
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS