CVE-2026-67541: Heym: Missing role gate in team-member management lets any member add/remove members, exposing team-shared credentials
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, team-member management (add / remove / update) is gated only on team membership, not on the team creator/admin role — and TeamMember has no role column. Any non-creator member can seat an attacker account into the team; because credential team-shares are scoped only by TeamMember.userid, the newly-added attacker can then decrypt every credential shared into that team (provider API keys, OAuth tokens. This issue has been patched in version 0.0.70.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Heymto a version that resolves this vulnerability.Fixed in 0.0.70
Event History
Frequently Asked Questions
Which deployments are affected?
Self-hosted Heym deployments running versions before 0.0.70 are affected where a team has non-creator members and credentials have been shared with that team.
What access does an attacker need?
An attacker needs membership in the target team. Any non-creator member can add an attacker-controlled account to the team, without requiring the team creator or admin role.
What can a newly added account access?
The added account can decrypt every credential shared into that team, including provider API keys and OAuth tokens. The affected member can also remove or update team members.
How can I determine whether exposure may have occurred?
Review team membership changes for accounts added by non-creator members, particularly before upgrading to 0.0.70. Treat credentials shared with teams containing unauthorized additions as potentially exposed.
What should be done if patching cannot happen immediately?
Restrict team membership to trusted users and monitor or prevent non-creator members from making membership changes. Rotate provider API keys and OAuth tokens shared with any team where unauthorized membership changes are suspected.