EUVD-2026-29868
GHSA-p953-2g5p-33c5
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated user needed (PR:L) and valid victim UUID must be known/guessed (AC:H); network reachable with no interaction; high confidentiality/integrity but limited availability impact, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation. Attackers can create workflows with execute nodes or agent subWorkflowIds pointing to victim workflow UUIDs to load and execute those workflows under attacker-controlled execution paths, exposing victim workflow outputs and triggering workflow nodes with unintended side effects.
AnalysisAI
Authorization bypass in Heym's workflow execution engine (versions before 0.0.21) allows any authenticated user to run workflows belonging to other users by referencing the victim's workflow UUIDs, exposing their outputs and triggering side-effecting nodes. The root cause is missing access validation on subworkflow and execute-node references (CWE-863), fixed upstream in pull request #93. No public exploit has been identified at time of analysis, and EPSS scores it at just 0.05% with CISA SSVC marking exploitation as 'none' - but SSVC rates the technical impact as total.
Technical ContextAI
Heym (published by heymrun) is a workflow/agent-orchestration platform where users build workflows composed of nodes, including 'execute' nodes and agent nodes that carry a subWorkflowId to invoke nested workflows by UUID. The vulnerability is an instance of CWE-863 (Incorrect Authorization): when a workflow references another workflow by UUID via an execute node or agent subWorkflowId, the engine loaded and ran the target without verifying that the requesting user owned or was authorized to access it. Because UUIDs act as the only reference and no ownership check gated resolution, an attacker could point their own attacker-controlled execution path at a victim's workflow. The fix (PR #93, 'fix(workflows): enforce subworkflow access checks', commit 3ae3ef6) adds the missing access validation before subworkflow load/execution. The single affected CPE is cpe:2.3:a:heymrun:heym:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: v0.0.21 - upgrade Heym to 0.0.21 or later, which enforces subworkflow access checks (PR https://github.com/heymrun/heym/pull/93, commit 3ae3ef6a7d3609da0e910f9ed6b81e99a1661ac8, release https://github.com/heymrun/heym/releases/tag/v0.0.21). If immediate upgrade is not possible, reduce exposure by treating the instance as single-tenant or restricting workflow-execution accounts to trusted users only, since exploitation requires an authenticated account, and by monitoring execution logs for workflows referencing subWorkflowIds or execute-node UUIDs the invoking user does not own; the trade-off is that these are detective/administrative controls that do not close the bypass and are impractical on genuinely multi-user instances. Note that v0.0.21 also bundles unrelated security fixes (Python tool sandbox hardening in PR #94 and stored upload path containment in PR #92), so upgrading is doubly beneficial.
Sandbox escape in Heym's custom Python tool executor (versions before 0.0.21) allows authenticated workflow authors to b
Arbitrary file write (and read/delete) in Heym before 0.0.21 lets an authenticated user escape the intended upload stora
Authenticated SSRF in the Heym workflow engine before v0.0.98 allows any workflow author to reach internal network servi
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today