Description

TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export endpoint to retrieve sensitive database contents as a downloadable spreadsheet, bypassing role-based access controls.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-24T15:16:37.940Z",
  "pubdate": "2026-08-24T15:16:37.940Z",
  "executiveSummary": "TIM Flow before 26.0.6 suffers from an improper authorization vulnerability residing within its privileged dashboard Excel export endpoint, which is explicitly intended for administrative use only.\nThe vulnerability allows any authenticated user to bypass established role-based access controls and submit arbitrary SQL queries directly to the backend database.\nBy crafting and submitting unauthorized database queries, an attacker can extract sensitive data and receive the contents as a downloadable spreadsheet.\nThis flaw presents significant risk implications regarding data confidentiality, exposing potentially critical enterprise information to unauthorized low-privileged accounts.\nExploitation requires network access to the application and a valid authenticated user session, but does not necessitate administrative privileges.\nOrganizations utilizing affected versions of the TIM Flow platform must apply vendor-supplied updates immediately to remediate the broken access control mechanism and secure the export functionality.",
  "technicalDetails": "The root cause of this security defect is an improper authorization check within the TIM Flow application prior to executing database queries initiated from the dashboard Excel export endpoint.\nAlthough the export endpoint is intended exclusively for administrative personnel, the application fails to adequately validate whether the requesting authenticated user possesses the requisite administrative role or privileges before processing the request.\nThe vulnerable component is the administrative dashboard export module, affecting all TIM Flow software installations prior to version 26.0.6.\nAuthentication is required to trigger the flaw, meaning an attacker must possess standard, low-privileged user credentials within the system.\nHowever, the absence of proper authorization validation allows these low-privileged users to bypass privilege boundaries completely.\nThe attack flow proceeds as follows: First, the authenticated attacker interacts with the dashboard export functionality. Second, instead of utilizing legitimate dashboard parameters, the attacker crafts an arbitrary SQL query payload designed to extract targeted database contents. Third, the attacker submits this payload to the privileged export endpoint. Fourth, because the endpoint lacks proper access control enforcement, the backend database executes the arbitrary SQL query supplied by the unprivileged user. Fifth, the application compiles the resulting dataset into a spreadsheet format. Finally, the server returns the downloadable spreadsheet containing sensitive database contents to the attacker, culminating in a severe breach of data confidentiality."
}