What’s Vulnerable › Vulnerabilities

CVE-2026-109362: Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-15
• Weakness: CWE-613

Description

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.

Affected products

• heymrun heym: from 0.0.5 before 0.0.113 — fixed in 0.0.113

How to fix

Upgrade to a fixed version: heymrun heym 0.0.113. Check the vendor advisory for mitigations.

References

• https://github.com/heymrun/heym/security/advisories/GHSA-pwr6-6377-3cgv
• https://www.vulncheck.com/advisories/heym-0.0.5-before-0.0.113-broken-access-control-via-workflow-execution-tokens
• https://github.com/heymrun/heym/security/advisories/GHSA-pwr6-6377-3cgv

Get alerted when CVE-2026-109362 or the next vulnerability affects your stack