PT-2026-1878 · Unknown+1 · Tim Bpm Suite+1

Publicado 2026-01-09 · Atualizado 2026-01-09 · CVE-2025-67282

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TIM BPM Suite/TIM FLOW versions through 9.1.2

Description The software contains multiple authorization bypass issues. A user with low privileges can download password hashes belonging to other users, access work items owned by other users, modify restricted content within workflows, alter the application's logo, and manipulate other user profiles.

Recommendations Update to a version later than 9.1.2. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

CVE-2025-67282

Produtos afetados

Tim Bpm Suite

Tim Flow

Referências · 6

• https://t.me/CVEtracker/41849 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-67282 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-67282 · Nota de Segurança
• https://twitter.com/CVEnew/status/2009663202087288948 · Publicação no Twitter
• https://y-security.de/news-en/tim-bpm-suite-tim-flow-multiple-vulnerabilities · Nota
• https://tim-doc.atlassian.net/wiki/spaces/eng/pages/230981636/Release+Notes · Nota