VULNERABILITY INTELLIGENCE
CVE-2026-39914
CVSS score7.1 HIGH
EPSS probability0.38%
CISA KEVNot currently listed
Published2026-08-24
Last modified2026-10-12
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export endpoint to retrieve sensitive database contents as a downloadable spreadsheet, bypassing role-based access controls.
Weakness classification
- CWE-862: Missing Authorization