HIGH 7.1 NVD
CVE-2026-39914
TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashb
TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export endpoint to retrieve sensitive database contents as a downloadable spreadsheet, bypassing role-based access controls.
References
- https://tim-doc.atlassian.net/wiki/spaces/eng/pages/230981636/Release+Notes
- https://www.vulncheck.com/advisories/tim-flow-unauthorized-sql-query-execution-via-dashboa
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-08-24 via NVD.
vulnfeed aggregates 11251 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.