Team Member Management Vulnerability in Heym Product by Heym

CVE-2026-67541

What is CVE-2026-67541?

The Heym product allows team members to manage other users without robust role verification. Prior to version 0.0.70, non-creator members could add unauthorized accounts, potentially enabling attackers to access sensitive credential information, such as API keys and OAuth tokens. This vulnerability arises from inadequate controls on team member permissions, exposing critical business-process automations to significant security risks. The issue has been mitigated in the latest release.

References