THREAT OPS › Threat News › [GHSA] GHSA-8mq9-5fw2-5rm4 (medium) — Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
[GHSA] GHSA-8mq9-5fw2-5rm4 (medium) — Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
GHSA-8mq9-5fw2-5rm4 Severity: medium CVE: CVE-2026-59992
Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
## Summary
The production media handler shipped by `next-tinacms-s3` (`createMediaHandler` in `packages/next-tinacms-s3/src/handlers.ts`) accepts an attacker-chosen `?key=` query parameter and returns an AWS-signed `
MITRE ATT&CK techniques
Indicators of compromise
- CVE-2026-59992cve
Original source: https://github.com/advisories/GHSA-8mq9-5fw2-5rm4