heymrun heym up to 0.0.20 authorization

Summaryinfo

A vulnerability was found in heymrun heym up to 0.0.20 and classified as problematic. This issue affects some unknown processing. The manipulation results in authorization. This vulnerability is cataloged as CVE-2026-45226. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in heymrun heym up to 0.0.20. It has been classified as problematic. Affected is an unknown code. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation. Attackers can create workflows with execute nodes or agent subWorkflowIds pointing to victim workflow UUIDs to load and execute those workflows under attacker-controlled execution paths, exposing victim workflow outputs and triggering workflow nodes with unintended side effects.

The weakness was shared by Chia Min Jun Lennon. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-45226 since 05/11/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. There are neither technical details nor an exploit publicly available.

Upgrading to version 0.0.21 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 3ae3ef6a7d3609da0e910f9ed6b81e99a1661ac8 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• heymrun

Name

• heym

Version

• 0.0.1
• 0.0.2
• 0.0.3
• 0.0.4
• 0.0.5
• 0.0.6
• 0.0.7
• 0.0.8
• 0.0.9
• 0.0.10
• 0.0.11
• 0.0.12
• 0.0.13
• 0.0.14
• 0.0.15
• 0.0.16
• 0.0.17
• 0.0.18
• 0.0.19
• 0.0.20

License

• open-source

Website

• Product: https://github.com/heymrun/heym/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion