What’s Vulnerable › Vulnerabilities

CVE-2026-39914: TIM Flow < 26.0.6 Unauthorized SQL Query Execution via Dashboard Export Endpoint

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-24 · updated 2026-10-12
• Weakness: CWE-862

Description

TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export endpoint to retrieve sensitive database contents as a downloadable spreadsheet, bypassing role-based access controls.

Affected products

• TIM Solutions TIM Flow: before 26.0.6 — fixed in 26.0.6

How to fix

Upgrade to a fixed version: TIM Solutions TIM Flow 26.0.6. Check the vendor advisory for mitigations.

References

• https://tim-doc.atlassian.net/wiki/spaces/eng/pages/230981636/Release+Notes
• https://www.vulncheck.com/advisories/tim-flow-unauthorized-sql-query-execution-via-dashboard-export-endpoint

Get alerted when CVE-2026-39914 or the next vulnerability affects your stack