Vulnerability · Published May 12, 2026 · Assigned by VulnCheck

CVE-2026-45226Heym < 0.0.21 Authorization Bypass in Workflow Execution

High 7.1

In plain English

A high-severity incorrect authorization in heym from heymrun. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 78.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation. Attackers can create workflows with execute nodes or agent subWorkflowIds pointing to victim workflow UUIDs to load and execute those workflows under attacker-controlled execution paths, exposing victim workflow outputs and triggering workflow nodes with unintended side effects.

Affected products (as reported)

Vendor	Product	Versions
heymrun	heym	0 – before 0.0.21

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

References

https://github.com/heymrun/heym/releases/tag/v0.0.21 release-notes
https://github.com/heymrun/heym/pull/93 issue-tracking
https://github.com/heymrun/heym/commit/3ae3ef6a7d3609da0e910f9ed6b81e99a1661ac8 patch
https://www.vulncheck.com/advisories/heym-authorization-bypass-in-workflow-execution third-party-advisory