Authorization Bypass in Heym Workflow Execution by Heymrun

CVE-2026-45226

What is CVE-2026-45226?

Heym, a workflow automation tool by Heymrun, has an authorization bypass vulnerability that allows authenticated users to execute arbitrary workflows. This occurs due to insufficient access validation when referencing victim workflow UUIDs, enabling attackers to initiate workflows with execute nodes or subWorkflowIds linked to these UUIDs. As a result, attackers can load and execute targeted workflows through unintended execution paths, which may expose sensitive outputs and trigger adverse effects in the victim workflows.

References