Authenticated object write/delete via unscoped storage keys

Broken access control in TinaCMS before 23.0.4 allows remote authenticated users to write or delete arbitrary storage objects via crafted media keys. In createMediaHandler and sibling adapter handlers, upload and delete paths pass req.query.key, req.query.media, or equivalent directory and filename inputs directly to storage SDK key fields without constraining them to the configured mediaRoot boundary. Any logged-in CMS editor that passes the deployment's authorized() check can therefore create or remove objects anywhere the backing storage credential can reach, including other tenants' assets or non-media content.