CVE-2026-63506

CVE-2026-63506 is an authorization bypass (CWE-639) in the self-hosted authentication logic of Tina, a headless CMS: the isAuthorized function in @tinacms/auth and next-tinacms-azure accepts a request-controlled clientID and validates the bearer token against that attacker-chosen TinaCloud app instead of the victim site's configured app. An attacker holding any valid TinaCloud account can submit their own app ID and token to a victim endpoint, causing TinaCloudBackendAuthProvider or affected media authorization callbacks to accept the attacker as verified across the tenant boundary. Successful exploitation permits listing, reading, uploading, or deleting media and, where TinaCloudBackendAuthProvider is used, GraphQL create, read, update, and delete operations on the victim's content, with no victim account or interaction required. Only self-hosted Tina deployments using @tinacms/auth prior to 1.1.4 or next-tinacms-azure prior to 15.0.1 are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the issue is not listed in CISA KEV.

What to do: Upgrade to @tinacms/auth 1.1.4 or later and next-tinacms-azure 15.0.1 or later, verifying the resolved versions in your lockfile (package-lock.json / yarn.lock). As an interim mitigation, restrict network access to Tina API and media routes and reject client-supplied clientID values in authorization checks. Review media and content audit logs for unexpected tokens or GraphQL mutations from unfamiliar TinaCloud apps that could indicate cross-tenant access.