CVE-2026-67541

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.70

Description Team-member management functions for adding, removing, and updating members are restricted only by team membership rather than requiring a team creator or admin role. This occurs because the TeamMember entity lacks a role column. Consequently, any member of a team can add an unauthorized account to the team. Since credential team-shares are scoped solely by TeamMember.user id, an unauthorized user can decrypt all credentials shared within that team, including provider API keys and OAuth tokens.

Recommendations Update to version 0.0.70.