CVE-2026-67541
Heym: Missing role gate in team-member management lets any member add/remove members, exposing team-shared credentials
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, team-member management (add / remove / update) is gated only on team membership, not on the team creator/admin role — and TeamMember has no role column. Any non-creator member can seat an attacker account into the team; because credential team-shares are scoped only by TeamMember.user_id, the newly-added attacker can then decrypt every credential shared into that team (provider API keys, OAuth tokens. This issue has been patched in version 0.0.70.
| CWE | CWE-266 CWE-862 |
| Vendor | heymrun |
| Product | heym |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for heymrun heym
Be the first to know when new high vulnerabilities affecting heymrun heym are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
heymrun / heym
< 0.0.70
References
github.com: https://github.com/heymrun/heym/security/advisories/GHSA-vxpw-x7j7-8723 github.com: https://github.com/heymrun/heym/commit/863e2702fca9a584246da9a51cca6b12828cebcf github.com: https://github.com/heymrun/heym/commit/a9fc3d864e87fa2449b235798189db9cd39367c4 github.com: https://github.com/heymrun/heym/commit/def26b5cf77dad4a9c5b5ff11c9863a0bc144ac8 github.com: https://github.com/heymrun/heym/releases/tag/0.0.70