GHSA-vxpw-x7j7-8723: Heym: Missing role gate in team-member management lets any member add/remove members, exposing team-shared credentials
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, team-member management (add / remove / update) is gated only on team membership, not on the team creator/admin role — and TeamMember has no role column. Any non-creator member can seat an attacker account into the team; because credential team-shares are scoped only by TeamMember.userid, the newly-added attacker can then decrypt every credential shared into that team (provider API keys, OAuth tokens. This issue has been patched in version 0.0.70.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Heymto a version that resolves this vulnerability.Fixed in 0.0.70
Event History
Frequently Asked Questions
Which deployments are affected?
Heym deployments running versions earlier than 0.0.70 are affected where teams have members and credentials shared with those teams. The issue is in self-hosted Heym team-member management.
What level of access does an attacker need?
An attacker needs to already be a member of the target team, even if they are not the team creator or administrator. That member can add an attacker-controlled account, remove members, or update team membership.
What could an unauthorized team member access?
After adding an attacker-controlled account to the team, the attacker can decrypt credentials shared with that team. This can include provider API keys and OAuth tokens.
How can I determine whether my deployment is vulnerable?
Deployments running a version before 0.0.70 should be treated as vulnerable. Review team memberships for accounts that should not belong to teams containing shared credentials.
What is the available remediation?
Upgrade Heym to version 0.0.70 or later, where the issue is patched. Because unauthorized members may have gained access to shared credentials, investigate unexpected team membership changes and consider rotating credentials shared with affected teams.