{"id":"EUVD-2026-95990","enisaUuid":"2c2bac45-05fd-36a9-b1a5-16e9681dc0db","description":"Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.","datePublished":"Oct 9, 2026, 8:43:37 PM","dateUpdated":"Oct 13, 2026, 11:24:15 AM","baseScore":9.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7\nhttps://github.com/tinacms/tinacms/pull/7522\nhttps://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf\nhttps://github.com/tinacms/tinacms/releases/tag/@tinacms/app@2.5.14\nhttps://github.com/tinacms/tinacms/releases/tag/tinacms@3.14.0\n","aliases":"CVE-2026-108261\nGHSA-x34j-47hf-4xg7\n","assigner":"GitHub_M","epss":0.2,"enisaIdProduct":[{"id":"4dd90414-521f-30bc-9e44-d5d7a25fe71f","product":{"name":"App","vendor":{"name":"Tuya"}},"product_version":"\u003c 2.5.14"},{"id":"5889e4d4-78e2-32c5-8065-7cd767881d85","product":{"name":"tinacms","vendor":{"name":"tinacms"}},"product_version":"\u003c 3.14.0"}],"enisaIdVendor":[{"id":"95613b11-cacd-33ff-9bf8-45a38dfaed8c","vendor":{"name":"tinacms"}},{"id":"982a8ef1-ee84-3b08-8d50-3c89dad451a3","vendor":{"name":"@tinacms"}}],"enisaIdVulnerability":[{"id":"75bbec69-4d70-35df-82a3-a4d679560758","vulnerability":{"id":"GHSA-x34j-47hf-4xg7","description":"TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment","datePublished":"Oct 9, 2026, 8:56:48 PM","dateUpdated":"Oct 9, 2026, 8:56:48 PM","baseScore":0.0,"references":"https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7\nhttps://github.com/tinacms/tinacms/pull/7522\nhttps://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf\nhttps://github.com/tinacms/tinacms\nhttps://github.com/tinacms/tinacms/releases/tag/@tinacms/app@2.5.14\nhttps://github.com/tinacms/tinacms/releases/tag/tinacms@3.14.0\n","enisa_id":"EUVD-2026-95990\n","aliases":"GHSA-x34j-47hf-4xg7\nCVE-2026-108261\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"83071cab-712b-3853-b41c-b0c12aea78eb","vulnerability":{"id":"CVE-2026-108261","description":"Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.","datePublished":"Oct 9, 2026, 8:43:37 PM","dateUpdated":"Oct 13, 2026, 11:24:15 AM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7\nhttps://github.com/tinacms/tinacms/pull/7522\nhttps://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf\nhttps://github.com/tinacms/tinacms/releases/tag/@tinacms/app@2.5.14\nhttps://github.com/tinacms/tinacms/releases/tag/tinacms@3.14.0\n","enisa_id":"EUVD-2026-95990\n","assigner":"GitHub_M","epss":0.2,"dataProcessed":"Oct 27, 2026, 7:17:12 AM","vulnerabilityProduct":[{"id":"48f975c8-0880-358a-ad30-fe09d91d33b6","product":{"name":"tinacms","vendor":{"name":"tinacms"}},"product_version":"\u003c 3.14.0"},{"id":"aab003c6-18fc-3da5-96d8-44db7288d782","product":{"name":"App","vendor":{"name":"Tuya"}},"product_version":"\u003c 2.5.14"}],"vulnerabilityVendor":[{"id":"1d152718-88e3-3bc0-acfd-a7dbfb19ec0f","vendor":{"name":"@tinacms"}},{"id":"6a111e1e-6993-39bd-a8fe-d6de9d6a56df","vendor":{"name":"tinacms"}}]}}],"enisaIdAdvisory":[]}