{"metadata": {"vulnerability": "CVE-2026-63506", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-07-16T21:49:52.069Z", "date_only": false, "value": "2026-07-16T21:49:52.069Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-63506", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-16T20:27:37.385Z", "date_only": false, "value": "2026-09-16T20:27:37.385Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-63506", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-16T20:27:37.385Z", "date_only": false, "value": "2026-09-16T20:27:37.385Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-63506", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-16T21:17:13Z", "date_only": false, "value": "2026-09-16T21:17:13Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-G74Q-6G2F-874X", "record": "GHSA-G74Q-6G2F-874X", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-16T21:17:13.163Z", "date_only": false, "value": "2026-09-16T21:17:13.163", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63506", "record": "FKIE_CVE-2026-63506", "field": "published"}, {"timestamp": "2026-09-17T14:59:00Z", "date_only": false, "value": "2026-09-17T14:59:00Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-G74Q-6G2F-874X", "record": "GHSA-G74Q-6G2F-874X", "field": "published"}, {"timestamp": "2026-09-17T14:59:00Z", "date_only": false, "value": "2026-09-17T14:59:00Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-G74Q-6G2F-874X", "record": "GHSA-G74Q-6G2F-874X", "field": "modified"}, {"timestamp": "2026-09-17T15:54:06.674Z", "date_only": false, "value": "2026-09-17T15:54:06.674922Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63506", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-17T15:54:06.674Z", "date_only": false, "value": "2026-09-17T15:54:06.674922Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63506", "record": "FKIE_CVE-2026-63506", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-17T15:54:38.071Z", "date_only": false, "value": "2026-09-17T15:54:38.071Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-63506", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-17T15:54:38.071Z", "date_only": false, "value": "2026-09-17T15:54:38.071Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63506", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-17T16:31:38.299Z", "date_only": false, "value": "2026-09-17T16:31:38.299143Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/09e9ca8d1a8f5cc601598c2f89ddcc36", "record": "CVE-2026-63506", "field": "creation_timestamp", "uuid": "54517b16-ded0-4ba5-9ee4-cf948e1ebed6", "content": "# CVE-2026-63506: CVE-2026-63506: Broken Access Control in TinaCMS isAuthorized Authentication Handler\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63506\n\n## Summary\nCVE-2026-63506 is a critical authorization bypass vulnerability in TinaCMS self-hosted backend authentication packages (@tinacms/auth and next-tinacms-azure). By exploiting a request-controlled clientID parameter, unauthenticated attackers with an active token for any developer-registered TinaCloud application can bypass tenant boundaries and execute unauthorized administrative operations, including full GraphQL database interactions and arbitrary media management.\n\n## TL;DR\nA broken access control flaw in TinaCMS's authorization handler allows attackers to bypass authentication on self-hosted instances using their own registered TinaCloud application credentials.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 8.8 (High)\n- **Exploit Status**: Proof-of-Concept / Conceptual\n- **KEV Status**: Not Listed\n- **Impact**: Bypass of administrative authentication leading to database and asset manipulation\n\n## Affected Systems\n\n- @tinacms/auth\n- next-tinacms-azure\n- tinacms\n- **@tinacms/auth**: < 1.1.4 (Fixed in: `1.1.4`)\n- **next-tinacms-azure**: < 15.0.1 (Fixed in: `15.0.1`)\n\n## Mitigation\n\n- Update @tinacms/auth to 1.1.4 or higher\n- Update next-tinacms-azure to 15.0.1 or higher\n- Explicitly pass NEXT_PUBLIC_TINA_CLIENT_ID to the isAuthorized function\n- Configure runtime verification to ensure clientID environment variables are not empty\n\n**Remediation Steps:**\n1. Analyze package.json dependencies for vulnerable versions of @tinacms/auth (< 1.1.4) or next-tinacms-azure (< 15.0.1)\n2. Execute npm install @tinacms/auth@1.1.4 next-tinacms-azure@15.0.1 to pull secure versions\n3. Locate self-hosted authentication handlers (e.g., api/tina/[...media].ts or api/gql.ts)\n4. Modify authentication calls to bind the configuration parameter explicitly: isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID)\n5. Redeploy the application and verify that requests passing arbitrary client IDs are rejected with a 401/403 status code\n\n## References\n\n- [TinaCMS Security Advisory (GHSA-g74q-6g2f-874x)](https://github.com/tinacms/tinacms/security/advisories/GHSA-g74q-6g2f-874x)\n- [TinaCMS Fix PR 7168](https://github.com/tinacms/tinacms/pull/7168)\n- [NVD Entry for CVE-2026-63506](https://nvd.nist.gov/vuln/detail/CVE-2026-63506)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63506) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/09e9ca8d1a8f5cc601598c2f89ddcc36"}, {"timestamp": "2026-09-17T16:35:04.838Z", "date_only": false, "value": "2026-09-17T16:35:04.838730Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/tinacms/tinacms/security/advisories/GHSA-g74q-6g2f-874x", "record": "CVE-2026-63506", "field": "creation_timestamp", "uuid": "7d7a7037-8af6-442e-b4f5-d3c46ceb0997", "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-g74q-6g2f-874x"}, {"timestamp": "2026-09-30T17:51:56.193Z", "date_only": false, "value": "2026-09-30T17:51:56.193", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63506", "record": "FKIE_CVE-2026-63506", "field": "lastModified"}]}