Improper Access Control in Heym's Agentic Systems Before Version 0.0.70
CVE-2026-67540

6.5MEDIUM

Key Information:

Vendor

Heymrun

Status
Heym
Vendor
CVE Published:
11 November 2026

What is CVE-2026-67540?

Prior to version 0.0.70, Heym's agentic systems have a defect in access control measures that allows authenticated users to retrieve templates intended for specific users. The vulnerability lies in the get_workflow_template and get_node_template functions, which fetch templates without enforcing visibility restrictions. As a result, any authenticated user can access a tenant's private templates, exposing sensitive data including node/edge graphs and shared email addresses. This issue has been resolved in the latest release, version 0.0.70.

Affected Version(s)

heym < 0.0.70

References

https://github.com/heymrun/heym/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/heymrun/heym/commit/4bcea469bfeee8c265...
x_refsource_MISC
https://github.com/heymrun/heym/releases/tag/0.0.70
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.