CVE-2026-110873 — Heym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id Field
Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is m…
Published: 2026-10-14 · CVSS: 7.1 · CVSS 4.0
Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner's decrypted credentials are injected and exfiltrated.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7