CVE-2026-109362

Name of the Vulnerable Software and Affected Versions Heym versions 0.0.5 through 0.0.112

Description Broken access control allows former collaborators to continue executing JWT-auth workflows. This occurs because scoped workflow:execute tokens remain valid even after a share has been removed. An attacker can generate a token with a Time To Live (TTL) of up to 10 years that the owner is unable to list or revoke, enabling the repeated execution of workflows using shared credentials.

Recommendations Update Heym to version 0.0.113 or later.