CVE-2026-39914 — TIM Flow < 26.0.6 Unauthorized SQL Query Execution via Dashboard Export Endpoint
TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export…
Published: 2026-08-24 · CVSS: 7.1 · CVSS 4.0
TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export endpoint to retrieve sensitive database contents as a downloadable spreadsheet, bypassing role-based access controls.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7