# CVE-2026-108261: TinaCMS admin preview iframe origin validation bypass

Source: https://junglewise.ai/threats/cve-2026-108261-tinacms-admin-preview-iframe-loads-an-attacker-controlled-origin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-09  
License: CC BY 4.0 with a link back

CVE-2026-108261 · Severity: critical · CVSS 9.3 · Published 2026-10-09

TinaCMS is a headless CMS that includes an admin dashboard with a preview iframe. The admin accepts an attacker-controlled origin from the URL fragment without validation, loads it in the iframe, and then treats it as trustworthy for API requests. An attacker can trick a logged-in editor into clicking a malicious link to read and modify all site content using the editor's authentication credentials.

Technologies: [tinacms (npm)](https://junglewise.ai/threats/technologies/tinacms). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [TinaCMS](https://junglewise.ai/threats/vendors/tinacms).

## Quick answers

**Is CVE-2026-108261 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108261 being exploited in the wild.

**How severe is CVE-2026-108261?** Critical severity, with a CVSS score of 9.3, published 9 October 2026.

**Which products and versions are affected?** @tinacms/app (npm) <= 2.5.13, SEMVER:introduced=0,fixed=2.5.14; tinacms (npm) <= 3.13.0, SEMVER:introduced=0,fixed=3.14.0; TinaCMS @Tinacms/App <=2.5.12; TinaCMS <=3.12.1.

**Is there a fix for CVE-2026-108261?** Yes. @tinacms/app (npm): upgrade to 2.5.14 or later; tinacms (npm): upgrade to 3.14.0 or later. Until then: Restrict editor access to TinaCMS admin until patched, or deploy a reverse proxy that validates URL fragments and blocks protocol-relative URLs in the /~/* route. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108261 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108261?** Check whether you run @tinacms/app (npm), tinacms (npm), TinaCMS @Tinacms/App or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @tinacms/app (npm): upgrade to 2.5.14 or later

  ```sh
  npm install @tinacms/app@2.5.14
  ```

- tinacms (npm): upgrade to 3.14.0 or later

  ```sh
  npm install tinacms@3.14.0
  ```


Restrict editor access to TinaCMS admin until patched, or deploy a reverse proxy that validates URL fragments and blocks protocol-relative URLs in the /~/* route.

## Technical details

The vulnerability stems from the router's splat parameter (`/~/*`) being directly assigned to the iframe source without same-origin validation. A crafted fragment like `#/~//attacker.example/p` becomes the protocol-relative URL `//attacker.example/p`, causing the admin to frame an external site. The same unvalidated URL is used to derive `expectedOrigin`, the only trust anchor for the admin-to-preview `postMessage` channel. The attacker's frame can then submit arbitrary GraphQL mutations, which execute with the signed-in editor's authentication token and return results to the attacker's origin. The vulnerability bypasses the incomplete fix in version 3.9.3 which added sender-side origin checks but never validated the URL being compared.

## Affected products

- TinaCMS TinaCMS <=3.12.1
- TinaCMS @tinacms/app <=2.5.12

## Identifiers

- CVE-2026-108261
- GHSA-x34j-47hf-4xg7

## Timeline

- 2026-10-09: disclosed

## Related threats

- [TinaCMS stored XSS in rich-text link and image rendering](https://junglewise.ai/threats/cve-2026-55661-tinacms-stored-xss-in-rich-text-link-and-image-rendering)
- [TinaCMS origin validation error in postMessage handlers](https://junglewise.ai/threats/cve-2026-55660-tinacms-origin-validation-error-in-postmessage-handlers)
- [TinaCMS path traversal in media upload handler](https://junglewise.ai/threats/cve-2026-28791-tinacms-path-traversal-in-media-upload-handler)
- [TinaCMS arbitrary code execution in markdown frontmatter](https://junglewise.ai/threats/cve-2025-68278-tinacms-arbitrary-code-execution-in-markdown-frontmatter)