CVE-2026-108261: TinaCMS CSRF Vulnerability via Preview Route

CVE-2026-108261 Overview

CVE-2026-108261 is an origin validation flaw [CWE-346] in TinaCMS, a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the admin preview route /~/* in packages/tinacms/src/admin/index.tsx turns an attacker-controlled hash-router splat into an off-origin iframe URL. The function getExpectedPreviewOrigin in preview-origin.ts derives the trusted origin from that same attacker-supplied URL, so the GraphQL message channel accepts messages from a frame the attacker chose.

Critical Impact
An unauthenticated attacker who sends a crafted link to a signed-in editor can issue GraphQL reads and mutations under that editor's credentials, exposing or modifying protected content.

Affected Products

TinaCMS tinacms package prior to 3.14.0
TinaCMS @tinacms/app package prior to 2.5.14
TinaCMS admin preview route /~/* in packages/tinacms/src/admin/index.tsx

Discovery Timeline

2026-10-09 - CVE-2026-108261 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108261

Vulnerability Analysis

TinaCMS renders a live preview inside an iframe hosted by the admin UI. The admin route /~/* reads the splat portion of the hash router and passes it to packages/@tinacms/app/src/preview.tsx as the iframe src. When the attacker supplies an absolute URL in that splat, the iframe loads an off-origin page.

The GraphQL message bridge in packages/@tinacms/app/src/lib/graphql-reducer.ts validates incoming postMessage events against an expectedOrigin. That value is produced by getExpectedPreviewOrigin(url, baseOrigin), which resolves the attacker-controlled URL and returns its origin. The trust anchor is read from the same input it is supposed to validate, collapsing the check.

Once the admin frames the attacker origin and treats it as the trusted preview, the attacker frame can post GraphQL queries and mutations. The admin executes them using the signed-in editor's session, enabling read or write access to protected content.

Root Cause

The root cause is improper origin validation [CWE-346]. getExpectedPreviewOrigin derived the expected origin from a URL supplied through the client-side hash router instead of from a server-anchored or window-anchored value. Any URL that reached the preview route also controlled the origin the admin would subsequently trust.

Attack Vector

The attack requires user interaction from an authenticated editor. The attacker crafts a link to the editor's TinaCMS admin whose hash-router splat points at an attacker-controlled URL, then delivers it through phishing, chat, or any channel the editor will click. When the editor is already signed in, the admin frames the malicious origin, trusts its messages, and relays GraphQL operations against the editor's session.

typescript

// Security patch in packages/@tinacms/app/src/lib/preview-origin.ts
// Scope the admin preview to the site's own origin (#7522)

/**
 * Returns the origin the preview iframe is allowed to be on.
 *
 * The admin only ever loads the preview from its own origin, so this is that
 * origin and nothing else. It is deliberately not derived from the preview URL:
 * reading the trust anchor out of a value the URL supplies is what allowed a
 * crafted link to nominate the origin it would then be trusted from.
 */
export const getPreviewOrigin = (): string =>
  typeof window !== 'undefined' ? window.location.origin : '';

Source: GitHub Commit b57dbf4

Detection Methods for CVE-2026-108261

Indicators of Compromise

Admin access logs showing navigation to /~/ routes whose hash-router splat contains an absolute URL pointing to an external domain.
Unexpected GraphQL mutations originating from editor sessions that do not correspond to content changes made in the admin UI.
Browser referrer or network telemetry showing TinaCMS admin pages loading iframes from third-party origins.

Detection Strategies

Review web server and CDN access logs for requests to the admin path containing #/~/http or #/~/https fragments, which indicate attempts to point the preview at an external origin.
Audit the content repository and GraphQL mutation history for changes made outside normal editorial workflows, correlating timestamps with suspicious admin link clicks.
Inspect running TinaCMS deployments for the vulnerable code paths in packages/@tinacms/app/src/lib/preview-origin.ts to confirm whether getExpectedPreviewOrigin or the patched getPreviewOrigin is in use.

Monitoring Recommendations

Monitor outbound requests from editor browsers for connections to unknown domains while the TinaCMS admin is open.
Alert on GraphQL schema introspection or bulk read operations issued from editor sessions during short time windows.
Instrument the admin frontend to log the resolved preview iframe origin and flag mismatches against the deployed site origin.

How to Mitigate CVE-2026-108261

Immediate Actions Required

Upgrade tinacms to version 3.14.0 or later and @tinacms/app to version 2.5.14 or later across all admin deployments.
Invalidate active editor sessions after upgrading to force re-authentication and clear any state established while the vulnerable code was running.
Notify editors not to click TinaCMS admin links received from untrusted sources until the patch is deployed.

Patch Information

The fix is published in tinacms 3.14.0 and @tinacms/app 2.5.14, landed via Pull Request #7522 and commit b57dbf4. The patch replaces getExpectedPreviewOrigin with getPreviewOrigin, which returns window.location.origin and ignores the preview URL entirely. See the GitHub Security Advisory GHSA-x34j-47hf-4xg7 for the full disclosure.

Workarounds

Restrict access to the TinaCMS admin interface behind network controls or SSO enforcement so unauthenticated attackers cannot deliver the hash-router payload to a logged-in editor through a public URL.
Deploy a Content Security Policy with a strict frame-src directive that limits iframe sources to the site's own origin, blocking off-origin preview frames.
Train editors to open the TinaCMS admin from bookmarks rather than clicking admin links in email or chat.

bash

# Example npm upgrade commands
npm install tinacms@^3.14.0
npm install @tinacms/app@^2.5.14

# Verify installed versions
npm ls tinacms @tinacms/app