{"vulnerability": "CVE-2026-108261", "sightings": [{"uuid": "323b4d08-1f5e-4171-a082-6072f6509634", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108261", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412934600245223", "content": "CVE-2026-108261 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108261https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7https://github.com/tinacms/tinacms/pull/7522https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecfhttps://github.com/tinacms/tinacms/releases/tag/@tinacms/app@2.5.14https://github.com/tinacms/tinacms/releases/tag/tinacms@3.14.0#tinacms #@tinacms #app#CVE_2026_108261#bot", "creation_timestamp": "2026-10-09T20:53:22.754600Z"}, {"uuid": "7d03d2bd-48de-4218-87de-a75a73f610d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108261", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxhx65zlvq2g", "content": "\ud83d\udd34 CVE-2026-108261 - Critical (9.3)\n\nTina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, th...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108261/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-09T21:46:36.678153Z"}, {"uuid": "1ec8fbf5-8c4a-4d3a-b137-1658d4c04b5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108261", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxhyddfa352h", "content": "\ud83d\udea8 CVE-2026-108261 \u2014 CVSS 9.3 CRITICAL\n\nTina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* adm...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108261\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-09T22:07:23.376889Z"}, {"uuid": "1b492f08-3fc2-422d-8606-4682c7f0b8f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-108261", "type": "published-proof-of-concept", "source": "https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7", "content": "", "creation_timestamp": "2026-09-16T22:02:13.000000Z"}, {"uuid": "93e51e62-beb8-48d6-8374-be3febf78816", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108261", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxiby6uadc2l", "content": "CVE-2026-108261 - tinacms\nThe TinaCMS admin interface builds the preview frame URL from the page\u2019s hash without confirming it points to the same site. An attacker can craft a link that makes the admin load an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#tinacms #npm #CVE #infosec", "creation_timestamp": "2026-10-10T01:00:06.512020Z"}, {"uuid": "4b56d47d-c6ea-4eb9-8132-05f1b9477ca5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108261", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mxjp6wa4ii2i", "content": "CVE-2026-108261 affects @tinacms/app below 2.5.14: TinaCMS builds its admin preview iframe from an attacker-controlled URL fragment. That origin becomes the postMessage trust anchor; the fixes are @tinacms/app 2.5.14 and tinacms 3.14.0. #software", "creation_timestamp": "2026-10-10T14:29:11.762012Z"}]}