CVE-2026-109362: Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Heymto a version that resolves this vulnerability.Fixed in 0.0.113
Event History
Frequently Asked Questions
Who is exposed to this issue?
Workflow owners who previously shared a workflow with collaborators are exposed if those collaborators could mint scoped workflow:execute JWTs before their access was removed. Former collaborators can continue using those tokens against the shared workflow.
What does an attacker need to exploit it?
The attacker needs prior collaborator access to the workflow and a previously minted scoped workflow:execute token. No further user interaction is required, and the token can have a TTL of up to 10 years.
What can a former collaborator do with a retained token?
They can repeatedly execute the workflow using the shared credentials consumed by that workflow. The described impact includes unauthorized use of those credentials rather than availability disruption.
Can an owner identify or revoke the affected tokens?
No. The owner cannot list or revoke the scoped workflow:execute tokens described in the advisory, so removing a collaborator's share does not invalidate tokens they already minted.
What should be done if immediate upgrading is not possible?
The provided information does not describe a token revocation workaround. Because retained tokens can continue executing workflows and consume shared credentials, rotating or replacing credentials used by affected workflows may reduce the impact while remediation is pending.