CVE-2026-59992Published

Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-59992

Published

tinacms

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "tinacms",
                    "product": "tinacms",
                    "versions": [
                        {
                            "version": "< 23.0.4",
                            "status": "affected"
                        }
                    ]
                }

next-tinacms-s3

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "tinacms",
                    "product": "next-tinacms-s3",
                    "versions": [
                        {
                            "version": "< 23.0.4",
                            "status": "affected"
                        }
                    ]
                }

next-tinacms-dos

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "tinacms",
                    "product": "next-tinacms-dos",
                    "versions": [
                        {
                            "version": "< 23.0.4",
                            "status": "affected"
                        }
                    ]
                }

next-tinacms-azure

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "tinacms",
                    "product": "next-tinacms-azure",
                    "versions": [
                        {
                            "version": "< 14.0.4",
                            "status": "affected"
                        }
                    ]
                }

next-tinacms-cloudinary

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "tinacms",
                    "product": "next-tinacms-cloudinary",
                    "versions": [
                        {
                            "version": "< 26.0.4",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON