Skip to content
OpenAdvisories

Package · npm

next-tinacms-azure

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.8
    CVE-2026-63506

    Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

    Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID and asks isUserAuthorized to validate the bearer token against that selected TinaCloud app instead of …

    tinacms tinacms next-tinacms-azure auth npm
  • Medium 5.4
    CVE-2026-59992

    Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

    Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SD…

    tinacms tinacms next-tinacms-azure next-tinacms-dos npm