CVE-2026-67540: Heym - Horizontal IDOR: get-by-id on workflow/node templates skips the visibility check the list path enforces
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, getworkflowtemplate / getnodetemplate fetches a template by ID with no visibility / author / sharedwith predicate, so any authenticated user can read (and use) any other tenant's private (visibility=specificusers) template — including its full node/edge graph and the email addresses it was shared with. The list endpoint enforces visibility correctly; the single-item get/use paths do not. This issue has been patched in version 0.0.70.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Heymto a version that resolves this vulnerability.Fixed in 0.0.70
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Heym user can exploit it against private workflow or node templates belonging to other tenants. The attacker only needs the target template's ID; no user interaction is required.
What information or access could an attacker obtain?
An attacker can read and use private templates configured with visibility=specific_users. Exposed data includes the full node and edge graph and the email addresses of users with whom the template was shared.
Are list endpoints also affected?
The list endpoint enforces template visibility correctly. The affected paths are the single-item get and use operations, including get_workflow_template and get_node_template.
What should teams do to remediate this?
Upgrade Heym to version 0.0.70, which patches the missing visibility, author, and shared_with checks.