Vulnerability · Published Aug 24, 2026 · Assigned by VulnCheck

CVE-2026-39914TIM Flow < 26.0.6 Unauthorized SQL Query Execution via Dashboard Export Endpoint

Medium 6.5

In plain English

A medium-severity missing authorization in TIM Flow from TIM Solutions. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 68.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export endpoint to retrieve sensitive database contents as a downloadable spreadsheet, bypassing role-based access controls.

Affected products (as reported)

Vendor	Product	Versions
TIM Solutions	TIM Flow	0 – before 26.0.6

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Release Notes release-notes
https://www.vulncheck.com/advisories/tim-flow-unauthorized-sql-query-execution-via-dashboard-export-endpoint third-party-advisory