---
title: "CVE-2026-63506: Tina - Broken Access Control"
description: "Tina headless CMS prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1 contains a broken access control caused by improper validation of bearer tokens against attacker-controlled client IDs, letting attackers perform unauthorized media and content operations across tenant boundaries without victim interaction."
url: https://panop.io/threat-heartbeat/CVE-2026-63506/
---

# CVE-2026-63506 Tina - Broken Access Control

Tina headless CMS prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1 contains a broken access control caused by improper validation of bearer tokens against attacker-controlled client IDs, letting attackers perform unauthorized media and content operations across tenant boundaries without victim interaction.

CVSS base score 8.8 /10

High

CISA KEV

Not listed

Public exploit

None known

Authentication

Required

EPSS

0.52% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-63506)

## Details

Type

Broken Access Control

Impact

Broken Access Control, Data Tampering, Information Disclosure

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Published

16 September 2026

Updated

15 October 2026

Weakness

[CWE-639](https://cwe.mitre.org/data/definitions/639.html)

## Vendor fix

Update to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1 or later.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-63506](https://nvd.nist.gov/vuln/detail/CVE-2026-63506)
- [https://github.com/tinacms/tinacms/commit/0a927a4f8d228dd05ee7ca4be32899bc190e73af](https://github.com/tinacms/tinacms/commit/0a927a4f8d228dd05ee7ca4be32899bc190e73af)
- [https://github.com/tinacms/tinacms/pull/7168](https://github.com/tinacms/tinacms/pull/7168)
- [https://github.com/tinacms/tinacms/releases/tag/@tinacms/auth@1.1.4](https://github.com/tinacms/tinacms/releases/tag/@tinacms/auth@1.1.4)
- [https://github.com/tinacms/tinacms/releases/tag/next-tinacms-azure@15.0.1](https://github.com/tinacms/tinacms/releases/tag/next-tinacms-azure@15.0.1)
- [https://github.com/tinacms/tinacms/security/advisories/GHSA-g74q-6g2f-874x](https://github.com/tinacms/tinacms/security/advisories/GHSA-g74q-6g2f-874x)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)