CVE-2026-109362: medium-severity vulnerability in heymrun heym
Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
heymrun · heymRelated CVEs — heymrun heym
In the same product, most dangerous first.
CVE-2026-100864HIGHheym before 0.0.91 Remote Code Execution via Expression EngineEPSS 0.9%CVE-2026-55376HIGHheym Python Tool Sandbox EscapeEPSS 0.5%CVE-2026-100865HIGHHeym before 0.0.53 Remote Code Execution via eval() Sandbox EscapeEPSS 0.4%CVE-2026-101050HIGHHeym before 0.0.53 Authentication Bypass via Telegram WebhookEPSS 0.4%CVE-2026-101049HIGHHeym before 0.0.53 Slack Webhook Signature Verification BypassEPSS 0.4%CVE-2026-45225HIGHHeym < 0.0.21 Path Traversal File Upload via upload_file()EPSS 0.4%