ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-39915

TIM Flow < 26.0.6 CRLF Injection via rt Parameter

CVSS 4.0 8.5 HIGHCVSS 3.1 8.1 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-39915

Published

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers. Attackers can craft malicious requests to induce authenticated users to execute arbitrary JavaScript in their browser context, enabling session token theft and account credential modification.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-39915

Published

TIM Flow

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "affected",
                    "vendor": "TIM Solutions",
                    "product": "TIM Flow",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver",
                            "lessThan": "26.0.6"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON