Heym CVE-2026-109362

Exploitation requires that the attacker previously held collaborator access to a Heym workspace and minted a scoped 'workflow:execute' JWT token while authorized; the flaw is that this token remains valid after the share is removed because it carries a long configurable TTL (up to 10 years) and cannot be listed or revoked by the owner. Limiting factors: the attacker must have been a legitimate collaborator at some point (PR:L - not an anonymous external attacker), must retain the previously issued token, and the target workflow must still exist and have functioning shared credentials. It does not require user interaction or any non-default configuration - the token-reuse-after-removal behavior is inherent to the affected versions.

This is a moderate, context-dependent issue rather than an urgent priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and score of 5.3 describe a network-reachable, low-complexity flaw requiring low privileges (PR:L) and no user interaction, with low confidentiality and integrity impact (VC:L/VI:L) and no availability impact (VA:N) or scope change to subsequent systems. Critically, PR:L reflects that the attacker must first have been a legitimate collaborator who minted a scoped 'workflow:execute' token - this is a post-access, trust-abuse scenario, not open internet-facing compromise. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no signal of active exploitation or automatable mass exploitation; the realistic threat is targeted abuse by a specific former collaborator rather than widespread attack. The signals are internally consistent (no CVSS-vs-description conflict), but the main aggravating factor not captured in the base score is the long-lived, non-revocable, non-listable token (up to 10-year TTL), which turns a one-time share into indefinite persistent access and is the real reason this warrants prompt patching in affected deployments.

A contractor is granted collaborator access to a Heym workspace and, before their access is revoked, mints a scoped 'workflow:execute' JWT with a multi-year TTL. After the owner removes the share, the former collaborator continues presenting the still-valid token to repeatedly execute the workflow and consume the owner's shared credentials, with no way for the owner to see or revoke the token. No public exploit code is required - only possession of a previously issued token.