CVE-2026-39914 describes an improper authorization vulnerability in TIM Solutions' TIM Flow product prior to version 26.0.6. Authenticated users can exploit this vulnerability by submitting crafted SQL queries to a privileged dashboard Excel export endpoint, which is intended only for administrative use. This allows unauthorized access to sensitive database contents by bypassing role-based access controls, potentially exposing confidential data. The vulnerability has a CVSS 4.0 score of 7.1, indicating high severity. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker with valid authentication can bypass intended role-based access controls to execute arbitrary SQL queries via the dashboard export endpoint. This can lead to unauthorized disclosure of sensitive database information in the form of downloadable Excel spreadsheets. The impact is limited to authenticated users but can result in significant data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the dashboard export endpoint to trusted administrative users only, and monitor for suspicious query activity if possible.