Heym · Heym · CVE-2026-109362
**Name of the Vulnerable Software and Affected Versions**
Heym versions 0.0.5 through 0.0.112
**Description**
Broken access control allows former collaborators to continue executing JWT-auth workflows. This occurs because scoped `workflow:execute` tokens remain valid even after a share has been removed. An attacker can generate a token with a Time To Live (TTL) of up to 10 years that the owner is unable to list or revoke, enabling the repeated execution of workflows using shared credentials.
**Recommendations**
Update Heym to version 0.0.113 or later.