Executive brief
TinaCMS is a headless CMS framework used to manage and edit website content. A critical flaw in its authentication library allows any user with a free TinaCloud account to gain full access to unrelated TinaCMS sites—including the ability to read, modify, and delete all content and media. The vulnerability requires no access to the victim's account and no user interaction; an attacker simply sends their own credentials with a specially crafted request.
Technical details
The vulnerability is a broken access control flaw in @tinacms/auth's isAuthorized() function (confirmed at commit 5a6839f, versions ≤1.1.3). The function reads clientID from the HTTP request query parameter (req.query.clientID) and uses it to validate the bearer token against identity.tinajs.io/v2/apps/${clientID}/currentUser, never comparing it to the site's configured TinaCloud app ID. An attacker with a valid TinaCloud token for their own app can pass ?clientID=<their-app> in the request; the identity server correctly authenticates the token against that app, and the victim site authorizes the attacker. The same pattern is replicated in all media handlers (Cloudinary, S3, DOS, Azure) and in TinaCloudBackendAuthProvider, the default auth backend deployed by tinacms init. Attack vectors include: (1) Media APIs grant list, read, upload (with public ACL), and delete on victim's CDN; (2) GraphQL backend grants full CRUD on victim's content when TinaCloudBackendAuthProvider is used. The advisory includes a working proof-of-concept. The fix requires binding the authorization decision to the site's configured clientID rather than the request value.
Affected products
- TinaCMS @tinacms/auth <= 1.1.3
- TinaCMS next-tinacms-azure <= 15.0.0
Timeline
- 2026-09-06: disclosed
- 2026-09-17: advisory: GitHub Security Advisory published
- 2026-09-17: patched: @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1 released