Privilege Escalation Vulnerability in TIM BPM Suite by TIM Solution GmbH
CVE-2025-67278

6.5MEDIUM

Key Information:

Vendor

TIM Solution GmbH

Status
TIM BPM Suite & TIM FLOW
Vendor
CVE Published:
9 January 2026

What is CVE-2025-67278?

A vulnerability has been identified in the TIM BPM Suite and TIM FLOW by TIM Solution GmbH that permits remote attackers to escalate their privileges. This is achieved through a specially crafted HTTP request, allowing unauthorized users to gain elevated permissions within the affected systems. Organizations utilizing versions prior to v.9.1.2 should take immediate action to mitigate potential risks associated with this vulnerability.

References

https://tim-doc.atlassian.net/wiki/spaces/eng/pages/23098...
https://www.y-security.de/news-en/tim-bpm-suite-tim-flow-...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.