https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 18 Sep 2026 01:19:15 +0000 https://vulnerability.circl.lu/sighting/7d7a7037-8af6-442e-b4f5-d3c46ceb0997/export {"uuid": "7d7a7037-8af6-442e-b4f5-d3c46ceb0997", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63506", "type": "published-proof-of-concept", "source": "https://github.com/tinacms/tinacms/security/advisories/GHSA-g74q-6g2f-874x", "content": "", "creation_timestamp": "2026-09-17T16:35:04.838730Z"} {"uuid": "7d7a7037-8af6-442e-b4f5-d3c46ceb0997", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63506", "type": "published-proof-of-concept", "source": "https://github.com/tinacms/tinacms/security/advisories/GHSA-g74q-6g2f-874x", "content": "", "creation_timestamp": "2026-09-17T16:35:04.838730Z"} https://vulnerability.circl.lu/sighting/7d7a7037-8af6-442e-b4f5-d3c46ceb0997/export Thu, 17 Sep 2026 16:35:04 +0000 https://vulnerability.circl.lu/sighting/54517b16-ded0-4ba5-9ee4-cf948e1ebed6/export {"uuid": "54517b16-ded0-4ba5-9ee4-cf948e1ebed6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63506", "type": "seen", "source": "https://gist.github.com/alon710/09e9ca8d1a8f5cc601598c2f89ddcc36", "content": "# CVE-2026-63506: CVE-2026-63506: Broken Access Control in TinaCMS isAuthorized Authentication Handler\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63506\n\n## Summary\nCVE-2026-63506 is a critical authorization bypass vulnerability in TinaCMS self-hosted backend authentication packages (@tinacms/auth and next-tinacms-azure). By exploiting a request-controlled clientID parameter, unauthenticated attackers with an active token for any developer-registered TinaCloud application can bypass tenant boundaries and execute unauthorized administrative operations, including full GraphQL database interactions and arbitrary media management.\n\n## TL;DR\nA broken access control flaw in TinaCMS's authorization handler allows attackers to bypass authentication on self-hosted instances using their own registered TinaCloud application credentials.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 8.8 (High)\n- **Exploit Status**: Proof-of-Concept / Conceptual\n- **KEV Status**: Not Listed\n- **Impact**: Bypass of administrative authentication leading to database and asset manipulation\n\n## Affected Systems\n\n- @tinacms/auth\n- next-tinacms-azure\n- tinacms\n- **@tinacms/auth**: < 1.1.4 (Fixed in: `1.1.4`)\n- **next-tinacms-azure**: < 15.0.1 (Fixed in: `15.0.1`)\n\n## Mitigation\n\n- Update @tinacms/auth to 1.1.4 or higher\n- Update next-tinacms-azure to 15.0.1 or higher\n- Explicitly pass NEXT_PUBLIC_TINA_CLIENT_ID to the isAuthorized function\n- Configure runtime verification to ensure clientID environment variables are not empty\n\n**Remediation Steps:**\n1. Analyze package.json dependencies for vulnerable versions of @tinacms/auth (< 1.1.4) or next-tinacms-azure (< 15.0.1)\n2. Execute npm install @tinacms/auth@1.1.4 next-tinacms-azure@15.0.1 to pull secure versions\n3. Locate self-hosted authentication handlers (e.g., api/tina/[...media].ts or api/gql.ts)\n4. Modify authentication calls to bind the configuration parameter explicitly: isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID)\n5. Redeploy the application and verify that requests passing arbitrary client IDs are rejected with a 401/403 status code\n\n## References\n\n- [TinaCMS Security Advisory (GHSA-g74q-6g2f-874x)](https://github.com/tinacms/tinacms/security/advisories/GHSA-g74q-6g2f-874x)\n- [TinaCMS Fix PR 7168](https://github.com/tinacms/tinacms/pull/7168)\n- [NVD Entry for CVE-2026-63506](https://nvd.nist.gov/vuln/detail/CVE-2026-63506)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63506) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T16:31:38.299143Z"} {"uuid": "54517b16-ded0-4ba5-9ee4-cf948e1ebed6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63506", "type": "seen", "source": "https://gist.github.com/alon710/09e9ca8d1a8f5cc601598c2f89ddcc36", "content": "# CVE-2026-63506: CVE-2026-63506: Broken Access Control in TinaCMS isAuthorized Authentication Handler\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63506\n\n## Summary\nCVE-2026-63506 is a critical authorization bypass vulnerability in TinaCMS self-hosted backend authentication packages (@tinacms/auth and next-tinacms-azure). By exploiting a request-controlled clientID parameter, unauthenticated attackers with an active token for any developer-registered TinaCloud application can bypass tenant boundaries and execute unauthorized administrative operations, including full GraphQL database interactions and arbitrary media management.\n\n## TL;DR\nA broken access control flaw in TinaCMS's authorization handler allows attackers to bypass authentication on self-hosted instances using their own registered TinaCloud application credentials.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 8.8 (High)\n- **Exploit Status**: Proof-of-Concept / Conceptual\n- **KEV Status**: Not Listed\n- **Impact**: Bypass of administrative authentication leading to database and asset manipulation\n\n## Affected Systems\n\n- @tinacms/auth\n- next-tinacms-azure\n- tinacms\n- **@tinacms/auth**: < 1.1.4 (Fixed in: `1.1.4`)\n- **next-tinacms-azure**: < 15.0.1 (Fixed in: `15.0.1`)\n\n## Mitigation\n\n- Update @tinacms/auth to 1.1.4 or higher\n- Update next-tinacms-azure to 15.0.1 or higher\n- Explicitly pass NEXT_PUBLIC_TINA_CLIENT_ID to the isAuthorized function\n- Configure runtime verification to ensure clientID environment variables are not empty\n\n**Remediation Steps:**\n1. Analyze package.json dependencies for vulnerable versions of @tinacms/auth (< 1.1.4) or next-tinacms-azure (< 15.0.1)\n2. Execute npm install @tinacms/auth@1.1.4 next-tinacms-azure@15.0.1 to pull secure versions\n3. Locate self-hosted authentication handlers (e.g., api/tina/[...media].ts or api/gql.ts)\n4. Modify authentication calls to bind the configuration parameter explicitly: isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID)\n5. Redeploy the application and verify that requests passing arbitrary client IDs are rejected with a 401/403 status code\n\n## References\n\n- [TinaCMS Security Advisory (GHSA-g74q-6g2f-874x)](https://github.com/tinacms/tinacms/security/advisories/GHSA-g74q-6g2f-874x)\n- [TinaCMS Fix PR 7168](https://github.com/tinacms/tinacms/pull/7168)\n- [NVD Entry for CVE-2026-63506](https://nvd.nist.gov/vuln/detail/CVE-2026-63506)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63506) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T16:31:38.299143Z"} https://vulnerability.circl.lu/sighting/54517b16-ded0-4ba5-9ee4-cf948e1ebed6/export Thu, 17 Sep 2026 16:31:38 +0000