CVE-2026-67541

Description

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, team-member management (add / remove / update) is gated only on team membership, not on the team creator/admin role — and TeamMember has no role column. Any non-creator member can seat an attacker account into the team; because credential team-shares are scoped only by TeamMember.user_id, the newly-added attacker can then decrypt every credential shared into that team (provider API keys, OAuth tokens. This issue has been patched in version 0.0.70.

References

• https://github.com/heymrun/heym/commit/863e2702fca9a584246da9a51cca6b12828cebcf
• https://github.com/heymrun/heym/commit/a9fc3d864e87fa2449b235798189db9cd39367c4
• https://github.com/heymrun/heym/commit/def26b5cf77dad4a9c5b5ff11c9863a0bc144ac8
• https://github.com/heymrun/heym/releases/tag/0.0.70
• https://github.com/heymrun/heym/security/advisories/GHSA-vxpw-x7j7-8723