medium5.4
CVE-2026-109362
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing sco…
Impact
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.
Affected products
| Product | Affected versions |
|---|---|
| Heym V0.0.5 | before 0.0.113 |
Versions were read from the advisory text. No structured product data has been published for this record yet.