CVE-2026-109362 — Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execu…
Published: 2026-10-12 · CVSS: 5.3 · CVSS 4.0
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7