npm/next-tinacms-azure CVE-2026-63506: high 8.8, EPSS 0.52%

Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

Action: Upgrade next-tinacms-azure to 15.0.1 or later.

npm i next-tinacms-azure@15.0.1

Affected

Fixed versions

Sources

• osv: GHSA-g74q-6g2f-874x#npm/next-tinacms-azure
• https://github.com/tinacms/tinacms/security/advisories/GHSA-g74q-6g2f-874x
• https://nvd.nist.gov/vuln/detail/CVE-2026-63506
• https://github.com/tinacms/tinacms/pull/7168
• https://github.com/tinacms/tinacms/commit/0a927a4f8d228dd05ee7ca4be32899bc190e73af
• https://github.com/tinacms/tinacms
• https://github.com/tinacms/tinacms/releases/tag/@tinacms/auth@1.1.4
• https://github.com/tinacms/tinacms/releases/tag/next-tinacms-azure@15.0.1

CVE-2026-63506 · published 2026-09-17T14:59:00Z · modified 2026-09-17T16:32:22.069506300Z · JSON