Read the docs
TI-2026-28785 Aliases CVE-2026-39914GHSA-jv9g-4xc8-gqg7

TIM Flow < 26.0.6 Unauthorized SQL Query Execution via Dashboard Export Endpoint

Priority LOW 31CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export endpoint to retrieve sensitive database contents as a downloadable spreadsheet, bypassing role-based access controls.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00375 31st percentileScored 2026-11-07
Fix Fixed TIM Flow (TIM Solutions): 26.0.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TIM SolutionsTIM Flowbefore 26.0.626.0.6Patch availableCNA
  • TIM Flow VendorTIM Solutions Affected before 26.0.6 Fixed in 26.0.6 Patch available CNA

Remediation

  • Fix · CNA TIM Flow (TIM Solutions) Fixed in 26.0.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    TIM Flow 26.0.6

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-28786 TIM Flow < 26.0.6 CRLF Injection via rt ParameterPriority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39914
  2. 2026-10-03 Alias added: GHSA-jv9g-4xc8-gqg7

References

Other 1

  • TI-2026-28786 TIM Flow < 26.0.6 CRLF Injection via rt Parameter CVSS 4.0HIGH 8.5
  • TI-2025-41177 An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote… CVSS 3.1MEDIUM 6.5
  • TI-2025-41178 An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote… CVSS 3.1MEDIUM 5.3
  • TI-2025-41181 In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities… CVSS 3.1MEDIUM 5.4
  • TI-2025-41180 In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists… CVSS 3.1MEDIUM 5.4
  • TI-2025-41179 In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection… CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences