Skip to content
Fencer Intel
high 8.1

CVE-2026-67541 json

Heym: Missing role gate in team-member management lets any member add/remove members, exposing team-shared credentials

published 4mo ago modified 12h ago also GHSA-vxpw-x7j7-8723 , EUVD-2026-124042

Unreviewed: the maintainers' own advisory

Published by the maintainers on their GitHub repository heymrun/heym. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, team-member management (add / remove / update) is gated only on team membership, not on the team creator/admin role — and TeamMember has no role column. Any non-creator member can seat an attacker account into the team; because credential team-shares are scoped only by TeamMember.user_id, the newly-added attacker can then decrypt every credential shared into that team (provider API keys, OAuth tokens. This issue has been patched in version 0.0.70.

Patch / fix

Is CVE-2026-67541 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

  • heymrun heym

Classification

Weakness
  • CWE-266 Incorrect Privilege Assignment
  • CWE-862 Missing Authorization

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of heymrun/heym published their own advisory on GitHub. Reviewed sources take precedence over it.