CVE-2026-108261 in Tina
Summary
by MITRE • 10/09/2026
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
TinaCMS is a headless content management system designed to provide developers with flexible tools for managing static site content through React components. The vulnerability identified involves the administrative preview functionality, specifically within the routing mechanisms that handle iframe-based previews of content changes before they are published. In versions prior to 3.14.0 and @tinacms/app 2.5.14, a critical flaw exists in how the application processes URL fragments containing hash-router splats. This architectural weakness allows an attacker-controlled input to manipulate the origin determination logic used for establishing secure communication channels between the admin interface and its preview iframe.
The technical root cause lies in the interaction between packages/tinacms/src/admin/index.tsx and packages/tinacms/app/src/preview.tsx. The /~/* route is intended to serve as a proxy or container for previewing content, but it fails to adequately sanitize or validate hash-router splat parameters that are derived from user-controlled URLs. When an attacker crafts a link containing specific malicious payloads within the URL fragment, this input propagates through the preview handling logic and ultimately influences the value of expectedOrigin in packages/tinacms/app/src/lib/preview-origin.ts. This variable is critical because it defines which origins are considered trusted for receiving GraphQL messages via postMessage or similar inter-frame communication methods.
By exploiting this flaw, an unauthenticated attacker can trick a signed-in editor into clicking a crafted link. Upon navigation, the TinaCMS admin interface loads the attacker-controlled URL within an iframe and incorrectly identifies that external origin as the legitimate preview source due to the flawed derivation of expectedOrigin from the manipulated hash-router splat. Consequently, the application treats the malicious frame as trusted, bypassing standard cross-origin security checks. This misconfiguration enables a severe Cross-Site Request Forgery (CSRF) variant or unauthorized API access scenario where the attacker's iframe can send GraphQL queries and mutations directly to the admin interface.
The operational impact of this vulnerability is significant for organizations relying on TinaCMS for content management. Since the malicious frame executes with the privileges of the currently signed-in editor, any GraphQL operations submitted by the attacker are processed using that user’s authentication credentials. This allows an unauthenticated external party to read sensitive protected content, modify existing entries, or potentially delete data depending on the permissions assigned to the targeted editor account. The attack vector is particularly dangerous because it relies on social engineering via a crafted link rather than requiring direct network access or exploitation of server-side infrastructure vulnerabilities.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-862 Missing Authorization, as the application fails to properly validate input that determines security boundaries and subsequently allows unauthorized actions based on misidentified origins. In terms of MITRE ATT&CK tactics, this behavior corresponds to T1534 Internal Spearphishing or T1078 Valid Accounts, where an attacker leverages valid user credentials through a deceptive interface interaction to gain access to restricted resources. The exploitation chain demonstrates how frontend routing logic errors can undermine backend security models that rely on origin-based trust assumptions.
Mitigation for this issue requires immediate upgrading of the TinaCMS ecosystem to version 3.14.0 and @tinacms/app to version 2.5.14 or later, where these input validation checks have been corrected. For organizations unable to upgrade immediately, implementing strict Content Security Policy (CSP) headers that restrict iframe sourcing can provide a layer of defense by preventing the loading of unauthorized origins regardless of how they are framed. Additionally, enforcing multi-factor authentication for administrative accounts reduces the risk associated with credential compromise through such phishing-based vectors. Regular security audits focusing on frontend routing and origin validation logic should be conducted to prevent similar misconfigurations in other web applications that utilize iframe previews or cross-origin messaging protocols.