Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110873Heym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id Field

High 7.1

In plain English

A high-severity incorrect authorization in heym from heymrun. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 88.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner's decrypted credentials are injected and exfiltrated.

Affected products (as reported)

Vendor	Product	Versions
heymrun	heym	0.0.55 – before 0.0.121

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

GitHub Security Advisory (GHSA-c3f4-2mrj-jfqr) vendor-advisory
VulnCheck Advisory: Heym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id Field third-party-advisory