PT-2026-40451 · Heym · Heym

Published 2026-05-12 · Updated 2026-05-13 · CVE-2026-45226

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.21

Description An authorization bypass exists in workflow execution allowing authenticated users to execute arbitrary workflows. By referencing victim workflow UUIDs without proper access validation, attackers can create workflows with execute nodes or agent subWorkflowIds pointing to those UUIDs. This allows the loading and execution of workflows under attacker-controlled paths, which can expose outputs and trigger nodes with unintended side effects.

Recommendations Update to version 0.0.21 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-45226

Affected Products

Heym

References · 8

• https://github.com/heymrun/heym/commit/3ae3ef6a7d3609da0e910f9ed6b81e99a1661ac8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45226 · Security Note
• https://github.com/heymrun/heym/releases/tag/v0.0.21 · Note
• https://github.com/heymrun/heym/pull/93 · Note
• https://twitter.com/CVEnew/status/2054323988239945938 · Twitter Post
• https://vulncheck.com/advisories/heym-authorization-bypass-in-workflow-execution · Note
• https://t.me/CVEtracker/53567 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2054412219769635144 · Twitter Post