{"action":"Upgrade @tinacms/auth to 1.1.4 or later.","affected":[{"fixed":"1.1.4","introduced":"0"}],"component":"@tinacms/auth","cve_ids":["CVE-2026-63506"],"ecosystem":"npm","epss":0.00523,"exploited":false,"fixed_versions":["1.1.4"],"ghsa_id":"GHSA-g74q-6g2f-874x","id":"tcs_01M5KFQEP4DDTJERBB1BNGF6EG","modified_at":"2026-09-17T16:32:22.069506300Z","published_at":"2026-09-17T14:59:00Z","references":["https://osv.dev/vulnerability/GHSA-g74q-6g2f-874x","https://github.com/tinacms/tinacms/security/advisories/GHSA-g74q-6g2f-874x","https://nvd.nist.gov/vuln/detail/CVE-2026-63506","https://github.com/tinacms/tinacms/pull/7168","https://github.com/tinacms/tinacms/commit/0a927a4f8d228dd05ee7ca4be32899bc190e73af","https://github.com/tinacms/tinacms","https://github.com/tinacms/tinacms/releases/tag/@tinacms/auth@1.1.4","https://github.com/tinacms/tinacms/releases/tag/next-tinacms-azure@15.0.1"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-g74q-6g2f-874x","url":"https://osv.dev/vulnerability/GHSA-g74q-6g2f-874x"}],"summary":"Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site"}