TIM Flow CVE-2026-39914

Exploitation requires a valid TIM Flow user account at any privilege level - the CVSS 4.0 vector confirms PR:L, meaning an authenticated but non-administrative session is sufficient. No special configuration, non-default feature flag, or specific deployment mode is required; the vulnerable export endpoint is a standard component of the administrative dashboard present in default deployments of TIM Flow before 26.0.6. The primary limiting factor is authentication: unauthenticated external attackers cannot exploit this directly and must first obtain any valid credential. No user interaction from a third party is required (UI:N), and no special timing or race condition applies (AT:N). Exploitation is limited in impact to read-only database access - the CVSS vectors confirm no integrity (VI:N) or availability (VA:N) impact, and scope is contained to the vulnerable system (SC:N/SI:N/SA:N).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) yields a score of 7.1, accurately reflecting a network-accessible, low-complexity exploit that requires only a standard authenticated session, with high confidentiality impact but no integrity or availability consequence. An independent CVSS 3.1 assessment yields 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), consistent with this profile. No EPSS data was available in the provided intelligence, and no CISA KEV listing or public proof-of-concept code has been identified, which moderates immediate alarm but does not diminish practical severity. The core risk driver is operational simplicity: any valid account holder can send a crafted HTTP request with no specialized tooling, making insider threats and compromised low-privilege credentials equally dangerous exploitation paths. The blast radius is bounded to read-only data exfiltration - integrity and availability are unaffected - but arbitrary SQL access to the application database likely encompasses credentials, business records, and PII depending on the schema. Organizations where TIM Flow is accessible to a broad or mixed-trust user population should treat this as a high-priority remediation item given the minimal exploitation prerequisites.

An authenticated TIM Flow user with no administrative role sends an HTTP POST request to the administrative dashboard Excel export endpoint, embedding a crafted SQL SELECT query targeting a sensitive table - for example, the user account table containing hashed passwords or the customer records table. The server executes the query using the application's database credentials, generates an Excel spreadsheet containing the result set, and returns it as a file download to the attacker's browser with no further interaction or privilege required.