How a Broken Preview Link in TinaCMS Lets Hackers Steal Editor Access

Security researchers identified a critical authentication bypass in the TinaCMS headless content management system, according to the National Vulnerability Database. The flaw, tracked as CVE-2026-108261, carries a CVSS score of 9.3, indicating severe risk. It affects all versions of tinacms prior to 3.14.0 and @tinacms/app prior to 2.5.14, leaving many installations exposed to session hijacking.

By the numbers

• 9.3: The CVSS base score assigned to CVE-2026-108261 by the National Vulnerability Database.
• 3.14.0: The specific version of the tinacms package that resolves the authentication bypass vulnerability.
• 2.5.14: The patched version for the separate @tinacms/app npm package required to fix the issue.

What the figures mean

The vulnerability exists because the TinaCMS admin interface builds preview iframe sources from hash router inputs without verifying they remain on the same origin, according to the GitHub advisory. When an attacker crafts a link with a doubled slash in the fragment, the system interprets it as a protocol-relative URL pointing to an external site. This external site is then loaded inside the trusted admin preview frame.

Because the system derives its trust anchor from that same unvalidated URL string, the attacker-controlled frame is treated as legitimate, according to the advisory. The attacker can then send GraphQL messages that the admin panel executes with the signed-in editor's authentication token. This allows the remote attacker to read or modify protected content without needing any credentials of their own.

The technical root cause lies in how react-router-dom handles the splat parameter for the `/~/*` route, according to the source material. The leading slash intended to force a relative path is combined with the router's output to create a double-slash sequence. This bypasses the expected origin checks in the GraphQL message channel, effectively handing over control of the content API to anyone who can trick an editor into clicking a link.

What to watch

Organizations using TinaCMS should verify their installed versions against the patched releases immediately, according to the National Vulnerability Database. The flaw requires no authentication for the attacker, meaning any user who clicks a malicious link can compromise the system. Security teams should monitor for unusual GraphQL activity originating from preview frames or unexpected cross-origin requests in their application logs.

What to do and how to stay safe: TinaCMS

• Check your current installation of tinacms and @tinacms/app to see if you are running versions prior to 3.14.0 and 2.5.14 respectively.
• Update to the patched versions as soon as they are available to close the authentication bypass and stop session hijacking.
• Review server logs for any requests to the `/~/*` admin preview route that originated from unexpected or external domains.
• Educate content editors on the risks of clicking unsolicited links, especially those that appear to be internal preview URLs, to reduce social engineering success.

Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan

General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What exactly does CVE-2026-108261 allow an attacker to do?

It allows an unauthenticated attacker to execute arbitrary GraphQL reads or mutations using the credentials of a signed-in editor who opens a crafted link.

Which specific versions of TinaCMS are affected by this vulnerability?

Versions of tinacms below 3.14.0 and versions of @tinacms/app below 2.5.14 are vulnerable, according to the advisory.

Is there a fix available for this critical authentication bypass?

Yes, the issue is fixed in tinacms version 3.14.0 and @tinacms/app version 2.5.14, according to the source material.