PT-2026-1878 · Unknown+1 · Tim Bpm Suite+1

Published 2026-01-09 · Updated 2026-01-09 · CVE-2025-67282

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TIM BPM Suite/TIM FLOW versions through 9.1.2

Description The software contains multiple authorization bypass issues. A user with low privileges can download password hashes belonging to other users, access work items owned by other users, modify restricted content within workflows, alter the application's logo, and manipulate other user profiles.

Recommendations Update to a version later than 9.1.2. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-67282

Affected Products

Tim Bpm Suite

Tim Flow

References · 6

• https://osv.dev/vulnerability/CVE-2025-67282 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67282 · Security Note
• https://t.me/CVEtracker/41849 · Telegram Post
• https://twitter.com/CVEnew/status/2009663202087288948 · Twitter Post
• https://y-security.de/news-en/tim-bpm-suite-tim-flow-multiple-vulnerabilities · Note
• https://tim-doc.atlassian.net/wiki/spaces/eng/pages/230981636/Release+Notes · Note