CVE-2026-108261 Details
Description
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.
A vulnerability in TinaCMS's admin preview feature allows an attacker to exploit the preview URL handling and gain unauthorized access to the site's content API. This issue affects TinaCMS versions prior to 3.14.0 and @tinacms/app versions prior to 2.5.14. The vulnerability arises because the admin preview route does not properly validate the origin of URLs derived from the router's hash fragment. An attacker can craft a link that, when opened by a logged-in editor, tricks the admin interface into loading an external site as a trusted preview. This external frame can then execute GraphQL operations using the editor's credentials, potentially exposing or modifying sensitive content.
Users can update to TinaCMS version 3.14.0 or @tinacms/app version 2.5.14 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7 | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf | [email protected] | Source CodeVendor |
| https://github.com/tinacms/tinacms/pull/7522 | [email protected] | Issue TrackingVendor |
| https://github.com/tinacms/tinacms/releases/tag/[email protected] | [email protected] | Release NotesVendor |
| https://github.com/tinacms/tinacms/releases/tag/@tinacms/[email protected] | [email protected] | Release NotesVendor |
| https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7 | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
| CWE-441 | Unintended Proxy or Intermediary ('Confused Deputy') | [email protected] |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TinaCMS | <= 3.13.0 (semver) |
CPE
Remediation
| |
| TinaCMS | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |