THREAT OPS › Threat News › [GHSA] GHSA-g74q-6g2f-874x (high) — Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
[GHSA] GHSA-g74q-6g2f-874x (high) — Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
GHSA-g74q-6g2f-874x Severity: high CVE: CVE-2026-63506
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
## Summary
`@tinacms/auth`'s `isAuthorized(req)` decides authorization by validating the caller's bearer token against `https://identity.tinajs.io/v2/apps/${req.query.clientID}/currentUser`, where the `clientID` comes from the request and is nev
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- 5a6839f95ca60d1b9f4032a3bed1ae4a338a4787sha1
- CVE-2026-63506cve
- https://identity.tinajs.io/v2/apps/${req.query.clientID}/currentUser`url
- https://identity.tinajs.io/v2/apps/${clientID}/currentUser`url
- https://identity.tinajs.iourl
- http://127.0.0.1:${IDENTITY_PORT}`url
- http://127.0.0.1:${VICTIM_PORT}`url
- owner@victim.exampleemail
- attacker@evil.exampleemail
Original source: https://github.com/advisories/GHSA-g74q-6g2f-874x