CVE-2026-39914

MediumCVSS 6.5

Published: 24/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 24/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

Improper authorization vulnerability in TIM Flow before 26.0.6 allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only.

Risk Assessment

An attacker could access sensitive database contents, bypassing role-based access controls.

Recommendation

Update TIM Flow to version 26.0.6 or later and restrict access to the export endpoint to administrators only.

Other vulnerabilities in TIM Flow

CVE-2026-39915High
TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers. Attackers can craft malicious requests to induce authenticated users to execute arbitrary JavaScript in their browser context, enabling session token theft and account credential modification.

Original NVD description (English source)

TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export endpoint to retrieve sensitive database contents as a downloadable spreadsheet, bypassing role-based access controls.