CVE-2026-108261 with a CVSS score of 9.3 is a critical origin-validation flaw in the TinaCMS admin preview component affecting @tinacms/app and tinacms. The admin builds the preview iframe source from a hash-router fragment without enforcing same-origin, so a crafted fragment can become a protocol-relative URL that loads an attacker-controlled site. Because the same unvalidated value also derives the expected origin used to trust postMessage traffic, the attacker's frame is accepted as the legitimate preview. An unauthenticated remote attacker can exploit this by convincing a signed-in editor to open a single malicious link; no server-side payload is required. The attacker's page can then send GraphQL operations to the admin, which executes them with the editor's authenticated token and returns results to the attacker. This yields arbitrary read and write access to the content API, including potential exposure of authentication data and destructive content changes, causing data loss, integrity damage, and unauthorized disclosure.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-108261 with a CVSS score of 9.3 is a critical origin-validation flaw in the TinaCMS admin preview component affecting @tinacms/app and tinacms. The admin builds the preview iframe source from a hash-router fragment without enforcing same-origin, so a crafted fragment can become a protocol-relative URL that loads an attacker-controlled site. Because the same unvalidated value also derives the expected origin used to trust postMessage traffic, the attacker's frame is accepted as the legitimate preview. An unauthenticated remote attacker can exploit this by convincing a signed-in editor to open a single malicious link; no server-side payload is required. The attacker's page can then send GraphQL operations to the admin, which executes them with the editor's authenticated token and returns results to the attacker. This yields arbitrary read and write access to the content API, including potential exposure of authentication data and destructive content changes, causing data loss, integrity damage, and unauthorized disclosure.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]