{"id":"EUVD-2026-63102","enisaUuid":"315baa15-c7b3-34e1-86b0-1382680a5c2e","description":"Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without enforcing the operator\u0027s configured mediaRoot. In packages/next-tinacms-s3/src/handlers.ts, createMediaHandler accepts req.query.key for a signed PutObject URL and the DELETE path uses req.query.media as the DeleteObjectCommand key. The same missing key-boundary check exists in packages/next-tinacms-dos/src/handlers.ts, packages/next-tinacms-azure/src/handlers.ts, and packages/next-tinacms-cloudinary/src/handlers.ts. An authenticated CMS editor can therefore create or delete objects anywhere the deployment\u0027s storage credential can reach, including other tenants\u0027 or non-media objects. These issues are fixed in next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4.","datePublished":"Aug 19, 2026, 9:30:51 PM","dateUpdated":"Aug 21, 2026, 4:48:12 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","references":"https://github.com/tinacms/tinacms/security/advisories/GHSA-8mq9-5fw2-5rm4\nhttps://github.com/tinacms/tinacms/pull/7088\nhttps://github.com/tinacms/tinacms/commit/d44558e9b4502d4f4fc2c970d22985339fe2b6ce\nhttps://github.com/tinacms/tinacms/releases/tag/next-tinacms-s3@23.0.4\n","aliases":"CVE-2026-59992\nGHSA-8mq9-5fw2-5rm4\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"2d1abda7-7e15-39c6-9144-e10aeb6bc509","product":{"name":"next-tinacms-azure","vendor":{"name":"tinacms"}},"product_version":"\u003c 14.0.4"},{"id":"39d72025-a53e-39d7-a51b-7fe642fe4ad1","product":{"name":"next-tinacms-dos","vendor":{"name":"tinacms"}},"product_version":"\u003c 23.0.4"},{"id":"52acb89c-19c2-3557-9cc4-2a4f2cd1231e","product":{"name":"next-tinacms-cloudinary","vendor":{"name":"tinacms"}},"product_version":"\u003c 26.0.4"},{"id":"67bcaddd-307e-32cb-a82b-254901d69bb8","product":{"name":"tinacms","vendor":{"name":"tinacms"}},"product_version":"\u003c 23.0.4"},{"id":"bcfd48b0-86c1-3e2e-bbf8-b974bc58cb4e","product":{"name":"next-tinacms-s3","vendor":{"name":"tinacms"}},"product_version":"\u003c 23.0.4"}],"enisaIdVendor":[{"id":"40490a82-78d7-321a-8315-29ed3e008cec","vendor":{"name":"tinacms"}}],"enisaIdVulnerability":[{"id":"7cb444ea-928f-3653-ba4b-6acb72e9b667","vulnerability":{"id":"GHSA-8mq9-5fw2-5rm4","description":"Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)","datePublished":"Aug 19, 2026, 9:56:30 PM","dateUpdated":"Aug 21, 2026, 6:31:05 PM","baseScore":0.0,"references":"https://github.com/tinacms/tinacms/security/advisories/GHSA-8mq9-5fw2-5rm4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59992\nhttps://github.com/tinacms/tinacms/pull/7088\nhttps://github.com/tinacms/tinacms/commit/d44558e9b4502d4f4fc2c970d22985339fe2b6ce\nhttps://github.com/tinacms/tinacms\nhttps://github.com/tinacms/tinacms/releases/tag/next-tinacms-s3@23.0.4\n","enisa_id":"EUVD-2026-63102\n","aliases":"CVE-2026-59992\nGHSA-8mq9-5fw2-5rm4\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:59:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9555fec8-49b2-37bc-9d55-acbf5e4dc4e7","vulnerability":{"id":"CVE-2026-59992","description":"Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without enforcing the operator\u0027s configured mediaRoot. In packages/next-tinacms-s3/src/handlers.ts, createMediaHandler accepts req.query.key for a signed PutObject URL and the DELETE path uses req.query.media as the DeleteObjectCommand key. The same missing key-boundary check exists in packages/next-tinacms-dos/src/handlers.ts, packages/next-tinacms-azure/src/handlers.ts, and packages/next-tinacms-cloudinary/src/handlers.ts. An authenticated CMS editor can therefore create or delete objects anywhere the deployment\u0027s storage credential can reach, including other tenants\u0027 or non-media objects. These issues are fixed in next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4.","datePublished":"Aug 19, 2026, 9:30:51 PM","dateUpdated":"Aug 21, 2026, 4:48:12 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","references":"https://github.com/tinacms/tinacms/security/advisories/GHSA-8mq9-5fw2-5rm4\nhttps://github.com/tinacms/tinacms/pull/7088\nhttps://github.com/tinacms/tinacms/commit/d44558e9b4502d4f4fc2c970d22985339fe2b6ce\nhttps://github.com/tinacms/tinacms/releases/tag/next-tinacms-s3@23.0.4\n","enisa_id":"EUVD-2026-63102\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Oct 30, 2026, 7:17:41 AM","vulnerabilityProduct":[{"id":"89bbdf3f-ff85-325a-bc76-3f9228d6cea6","product":{"name":"next-tinacms-dos","vendor":{"name":"tinacms"}},"product_version":"\u003c 23.0.4"},{"id":"cdaf0b11-ce0c-3981-b3b8-5626b381710b","product":{"name":"next-tinacms-s3","vendor":{"name":"tinacms"}},"product_version":"\u003c 23.0.4"},{"id":"ce677c90-afc2-32f8-b42c-2e805287c5cf","product":{"name":"next-tinacms-azure","vendor":{"name":"tinacms"}},"product_version":"\u003c 14.0.4"},{"id":"e01bf1fd-597c-354c-a854-6926c0c182b8","product":{"name":"tinacms","vendor":{"name":"tinacms"}},"product_version":"\u003c 23.0.4"},{"id":"fc711e35-1115-3bf0-8b9b-f9e2e88456ee","product":{"name":"next-tinacms-cloudinary","vendor":{"name":"tinacms"}},"product_version":"\u003c 26.0.4"}],"vulnerabilityVendor":[{"id":"12e41f91-66ec-346c-9f0a-d10f72140f50","vendor":{"name":"tinacms"}}]}}],"enisaIdAdvisory":[]}