← Back

CVE-2025-67282

nvd nist
Published: Jan 9, 2026Modified: Jan 22, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.5
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists which allow a low privileged user to download password hashes of other user, access work items of other user, modify restricted content in workflows, modify the applications logo and manipulate the profile of other user.

Affected (1)

Tim Solutions
1 product
Tim Flow
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Tim Flow
Before 9.1.2

Related CWEs

CWE-288
Authentication Bypass Using an Alternate Path or Channel
A product requires authentication, but the product has an alternate path or channel that does not require authentication.

References (2)

Source: cve@mitre.org
Release Notes
Source: cve@mitre.org
Third Party Advisory

Timeline

No history available yet.