Broken Access Control in Heym by Heymrun
CVE-2026-109362

5.3MEDIUM

Key Information:

Vendor

Heymrun

Status
Heym
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109362?

Heym v0.0.5 prior to v0.0.113 exhibits a broken access control flaw. This vulnerability enables former collaborators to misuse JWT-auth workflows, allowing them to execute scoped workflow:execute tokens even after their access has been revoked. Attackers can generate a token with an exceptionally long time-to-live (TTL) of up to 10 years, making it possible to execute workflows repeatedly using shared credentials, without the original owner's capability to list or revoke such tokens.

Affected Version(s)

heym 0.0.5 < 0.0.113

heym 0.0.113

References

https://github.com/heymrun/heym/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/heym-0.0.5-before-0....
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aman-goel-04
.