CVE-2026-108261

Received Received - Intake

Open Redirect in TinaCMS Admin Preview

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: GitHub, Inc.

Description

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-09

Last Modified

2026-10-09

Generated

2026-10-10

AI Q&A

2026-10-10

EPSS Evaluated

N/A

NVD

CVE-2026-108261

Affected Vendors & Products

Vendor	Product	Version / Range
tinacms	tinacms	< 3.14.0
@tinacms	app	< 2.5.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.
CWE-441	The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Tina headless CMS. It allows an unauthenticated attacker to craft a link that, when clicked by a signed-in editor, causes the admin interface to load an attacker-controlled iframe from a different origin. The iframe appears trusted but executes GraphQL operations with the editor's credentials, potentially exposing or modifying protected content.

Impact Analysis

If you use a vulnerable version of Tina CMS, an attacker could trick an authorized editor into clicking a malicious link. This could lead to unauthorized access to sensitive content, data leaks, or unauthorized modifications to your CMS content through GraphQL operations performed with the editor's privileges.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate GDPR (data protection) or HIPAA (health information privacy) requirements. Organizations using vulnerable versions may face compliance violations, data breaches, and potential legal consequences if exploited.

Mitigation Strategies

Update TinaCMS to version 3.14.0 or later and @tinacms/app to version 2.5.14 or later to patch the vulnerability.

Hi! I’m here to help you understand CVE-2026-108261. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70