CVE-2025-67282

5.4 mediumEPSS 0.2%

Medium (5.4) in tim-solutions tim flow. EPSS 0.2% chance of exploitation in the next 30 days.

In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists which allow a low privileged user to download password hashes of other user, access work items of other user, modify restricted content in workflows, modify the applications logo and manipulate the profile of other user.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-288
Published: 2026-01-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tim-solutions:tim_flow

References

https://tim-doc.atlassian.net/wiki/spaces/eng/pages/230981636/Release+Notes
https://www.y-security.de/news-en/tim-bpm-suite-tim-flow-multiple-vulnerabilities/

Check your stack JSON