CVE-2026-59992 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
Authenticated CMS editors can write or delete arbitrary storage objects by bypassing mediaRoot restrictions in TinaCMS production media adapters.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59992?
CVE-2026-59992 is a medium-severity missing authorization vulnerability in next-tinacms-azure, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without enforcing the operator's configured mediaRoot. In packages/next-tinacms-s3/src/handlers.ts, createMediaHandler accepts req.query.key for a signed PutObject URL and the DELETE path uses req.query.media as the DeleteObjectCommand key. The same missing key-boundary check exists in packages/next-tinacms-dos/src/handlers.ts, packages/next-tinacms-azure/src/handlers.ts, and packages/next-tinacms-cloudinary/src/handlers.ts. An authenticated CMS editor can therefore create or delete objects anywhere the deployment's storage credential can reach, including other tenants' or non-media objects. These issues are fixed in next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4.
Which versions are affected by CVE-2026-59992?
8 open source packages ship an affected version, including next-tinacms-azure, next-tinacms-cloudinary and next-tinacms-dos.
| Package | Affected | Fixed in |
|---|---|---|
next-tinacms-azure npm | All versions | 14.0.4 |
next-tinacms-azure npm | All versions | 14.0.4 |
next-tinacms-cloudinary npm | All versions | 26.0.4 |
next-tinacms-cloudinary npm | All versions | 26.0.4 |
next-tinacms-dos npm | All versions | 23.0.4 |
next-tinacms-dos npm | All versions | 23.0.4 |
2 more packages
next-tinacms-s3 npm | All versions | 23.0.4 |
next-tinacms-s3 npm | All versions | 23.0.4 |
How do I fix CVE-2026-59992?
Upgrade next-tinacms-azure to 14.0.4 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-59992 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59992 exists.
Sources
Also known as GHSA-8mq9-5fw2-5rm4.