CVE-2026-45226
Heym < 0.0.21 Authorization Bypass in Workflow Execution
- State
- Published
- Severity
- 7.6 High
- Published
- May 12, 2026
- Updated
- Jul 14, 2026
- Reserved
- May 11, 2026
Description
Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation. Attackers can create workflows with execute nodes or agent subWorkflowIds pointing to victim workflow UUIDs to load and execute those workflows under attacker-controlled execution paths, exposing victim workflow outputs and triggering workflow nodes with unintended side effects.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.6 High | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
heymheymrun |
|
References
- https://github.com/heymrun/heym/releases/tag/v0.0.21release-notes
- https://github.com/heymrun/heym/pull/93issue-tracking
- https://github.com/heymrun/heym/commit/3ae3ef6a7d3609da0e910f9ed6b81e99a1661ac8patch
- https://www.vulncheck.com/advisories/heym-authorization-bypass-in-workflow-executionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.