{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/@tinacms/auth/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@tinacms/auth","next-tinacms-cloudinary","next-tinacms-azure","next-tinacms-dos"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["TinaCMS"],"content_html":"\u003cp\u003eThe \u003ccode\u003e@tinacms/auth\u003c/code\u003e package contains a critical broken access control vulnerability (confirmed at commit 5a6839f) that permits unauthorized cross-tenant access. The \u003ccode\u003eisAuthorized(req)\u003c/code\u003e function performs authorization by validating a bearer token against an identity provider endpoint (\u003ccode\u003ehttps://identity.tinajs.io/v2/apps/${req.query.clientID}/currentUser\u003c/code\u003e). Crucially, the function retrieves the \u003ccode\u003eclientID\u003c/code\u003e from the user-provided request parameters rather than comparing it against the site's locally configured TinaCloud application ID.\u003c/p\u003e\n\u003cp\u003eAn attacker with a standard TinaCloud account can exploit this by creating their own application, obtaining a valid token, and submitting requests to a victim site with their own \u003ccode\u003eclientID\u003c/code\u003e and token. The victim's application incorrectly validates the credentials against the attacker's own app, returning an authorized response. This vulnerability exposes critical functionality, including media bucket management and full GraphQL content read/write/delete capabilities when using the default \u003ccode\u003eTinaCloudBackendAuthProvider\u003c/code\u003e. The flaw exists across multiple integration libraries, including \u003ccode\u003enext-tinacms-cloudinary\u003c/code\u003e, \u003ccode\u003enext-tinacms-azure\u003c/code\u003e, and \u003ccode\u003enext-tinacms-dos\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker registers a free TinaCloud account and creates a personal application to obtain a valid \u003ccode\u003eclientID\u003c/code\u003e and bearer token.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a target self-hosted TinaCMS site that utilizes the vulnerable \u003ccode\u003e@tinacms/auth\u003c/code\u003e package or its derived media-store integrations.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP request (e.g., \u003ccode\u003eGET /api/cloudinary/media\u003c/code\u003e) targeting the victim's API endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker includes their own \u003ccode\u003eclientID\u003c/code\u003e as a query parameter and their own valid TinaCloud bearer token in the \u003ccode\u003eAuthorization\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003eThe victim's backend calls \u003ccode\u003eisAuthorized(req)\u003c/code\u003e, which incorrectly performs a look-up at \u003ccode\u003eidentity.tinajs.io\u003c/code\u003e using the attacker-supplied \u003ccode\u003eclientID\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe identity provider returns a successful validation status because the credentials are valid for the attacker's own app.\u003c/li\u003e\n\u003cli\u003eThe victim's backend logic, failing to pin the \u003ccode\u003eclientID\u003c/code\u003e to the site-specific ID, returns an \u003ccode\u003eauthorized: true\u003c/code\u003e response to the media or GraphQL handler.\u003c/li\u003e\n\u003cli\u003eThe attacker performs unauthorized actions, such as reading private media, uploading arbitrary files to the victim's CDN, or deleting/modifying site content.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to gain editor-level control over unrelated TinaCMS tenants. Impacts include the ability to list, read, or delete sensitive files within the victim's media bucket. Furthermore, when \u003ccode\u003eTinaCloudBackendAuthProvider\u003c/code\u003e is active, the attacker gains full GraphQL access, enabling the exfiltration of site content or the injection of malicious data into the CMS.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately audit all instances of \u003ccode\u003e@tinacms/auth\u003c/code\u003e and associated media/backend providers in self-hosted TinaCMS deployments.\u003c/li\u003e\n\u003cli\u003eImplement strict server-side validation to ensure the \u003ccode\u003eclientID\u003c/code\u003e provided in incoming requests matches the hard-coded or environment-configured application ID for that specific site.\u003c/li\u003e\n\u003cli\u003eAvoid relying solely on the return value of \u003ccode\u003eisAuthorized(req)\u003c/code\u003e without verifying that the returned \u003ccode\u003euser\u003c/code\u003e object's associated \u003ccode\u003eappId\u003c/code\u003e matches the expected deployment identifier.\u003c/li\u003e\n\u003cli\u003eBlock or monitor suspicious inbound requests to \u003ccode\u003e/api/cloudinary/media\u003c/code\u003e or \u003ccode\u003e/api/tina/gql\u003c/code\u003e where the \u003ccode\u003eclientID\u003c/code\u003e parameter does not match your organization's known TinaCloud \u003ccode\u003eclientID\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-17T19:14:33Z","date_published":"2026-09-17T19:14:33Z","id":"https://feed.craftedsignal.io/briefs/2026-09-tinacms-auth-bypass/","summary":"A broken access control vulnerability in @tinacms/auth allows attackers to perform unauthorized actions by supplying their own valid TinaCloud credentials against a victim's TinaCMS deployment.","title":"Broken Access Control in TinaCMS Authorization","url":"https://feed.craftedsignal.io/briefs/2026-09-tinacms-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - @Tinacms/Auth","version":"https://jsonfeed.org/version/1.1"}