CVE-2026-59992: Tina CMS Auth Bypass Vulnerability

CVE-2026-59992 Overview

CVE-2026-59992 affects Tina, a headless content management system (CMS), specifically the first-party production media adapters for Amazon S3, DigitalOcean Spaces, Azure Blob Storage, and Cloudinary. The vulnerability stems from missing enforcement of the operator's configured mediaRoot boundary in upload and delete handlers. Authenticated CMS editors can pass attacker-controlled object keys to storage SDK operations, reaching objects outside the intended media directory. This authorization flaw is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
An authenticated CMS editor can create or delete arbitrary objects anywhere the deployment's storage credential can reach, including other tenants' data or non-media objects in shared buckets.

Affected Products

next-tinacms-s3 prior to 23.0.4
next-tinacms-dos prior to 23.0.4
next-tinacms-azure prior to 14.0.4
next-tinacms-cloudinary prior to 26.0.4

Discovery Timeline

2026-08-19 - CVE-2026-59992 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-59992

Vulnerability Analysis

The flaw exists in the production media adapters that Tina ships for cloud object storage backends. In packages/next-tinacms-s3/src/handlers.ts, createMediaHandler accepts req.query.key and passes it directly to a signed PutObject URL. The DELETE path similarly consumes req.query.media as the DeleteObjectCommand key without validation. The same missing key-boundary check appears in the DigitalOcean Spaces, Azure, and Cloudinary adapters at packages/next-tinacms-dos/src/handlers.ts, packages/next-tinacms-azure/src/handlers.ts, and packages/next-tinacms-cloudinary/src/handlers.ts.

Root Cause

The handlers trust client-supplied object identifiers without verifying that the resolved key remains within the mediaRoot configured by the operator. Because the storage credential often has broad permissions across an entire bucket or container, this trust boundary omission collapses tenant and directory isolation. Any authenticated editor can craft requests that write or delete objects outside the intended scope.

Attack Vector

An authenticated CMS editor issues a media upload or delete request with a key or media parameter that traverses outside the configured mediaRoot. The handler forwards the raw value to the storage SDK, which executes the operation against the target key. In multi-tenant deployments or environments where the storage credential reaches non-media objects, this enables cross-tenant object creation and destruction.

typescript

// Patch excerpt: packages/next-tinacms-azure/src/handlers.ts
 import type { MediaListOptions } from 'tinacms';
 import path from 'node:path';
 import { type NextRequest, NextResponse } from 'next/server';
+import { resolveKey, resolveDirectory, MediaKeyError } from './media-key';
 
 type RouteParams = { params: { media: string[] } };

Source: tinacms commit d44558e

typescript

// Patch excerpt: packages/next-tinacms-cloudinary/src/handlers.ts
 import { NextApiRequest, NextApiResponse } from 'next';
 import multer from 'multer';
 import { promisify } from 'util';
+import { resolveKey, resolveDirectory, MediaKeyError } from './media-key';
 
 export interface CloudinaryConfig {
   cloud_name: string;

Source: tinacms commit d44558e. The fix introduces resolveKey and resolveDirectory helpers that enforce mediaRoot scoping and raise MediaKeyError on boundary violations.

Detection Methods for CVE-2026-59992

Indicators of Compromise

Media handler requests containing key or media query parameters with values that traverse outside the configured mediaRoot, including ../ sequences or absolute paths.
Storage access logs (S3 CloudTrail, Azure Blob diagnostic logs, DigitalOcean Spaces access logs) showing PutObject or DeleteObject events on prefixes unrelated to Tina media.
Unexpected object deletions or new objects appearing outside the media directory during Tina editor sessions.

Detection Strategies

Compare authenticated CMS editor activity against storage backend audit trails, flagging operations whose object key does not begin with the deployed mediaRoot value.
Inspect application logs for calls into createMediaHandler and the corresponding DELETE route where the incoming req.query.key or req.query.media does not normalize inside mediaRoot.
Correlate CMS editor identity with storage-plane write and delete events to surface privilege boundary violations.

Monitoring Recommendations

Enable object-level logging on the storage backend and alert on writes or deletes outside the media prefix.
Track version counts on next-tinacms-s3, next-tinacms-dos, next-tinacms-azure, and next-tinacms-cloudinary across build pipelines to identify unpatched deployments.
Alert on repeated MediaKeyError occurrences after patching, which indicate probing attempts against the newly enforced boundary.

How to Mitigate CVE-2026-59992

Immediate Actions Required

Upgrade next-tinacms-s3 to 23.0.4, next-tinacms-dos to 23.0.4, next-tinacms-azure to 14.0.4, and next-tinacms-cloudinary to 26.0.4.
Audit storage backend logs for PutObject and DeleteObject operations issued outside the configured mediaRoot since the adapters were deployed.
Restrict the storage credential used by Tina to a bucket, container, or prefix that matches mediaRoot and nothing else.

Patch Information

The fix is delivered in the next-tinacms-s3@23.0.4 release with equivalent releases for the DigitalOcean Spaces, Azure, and Cloudinary adapters. See GHSA-8mq9-5fw2-5rm4 and pull request 7088 for the full remediation, which adds resolveKey, resolveDirectory, and MediaKeyError helpers to enforce the mediaRoot boundary.

Workarounds

Scope the storage credential to a dedicated bucket or container that contains only Tina media, so a key-boundary bypass cannot reach other tenants or systems.
Place an API gateway or reverse proxy in front of the media handler routes that rejects requests whose key or media parameters do not begin with the configured mediaRoot.
Limit CMS editor accounts to trusted personnel until patched versions are deployed, since exploitation requires authenticated editor privileges.

bash

# Example: upgrade the affected Tina media adapters
npm install next-tinacms-s3@23.0.4 \
            next-tinacms-dos@23.0.4 \
            next-tinacms-azure@14.0.4 \
            next-tinacms-cloudinary@26.0.4