high7.1
CVE-2026-110873
Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id beca…
Impact
Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner's decrypted credentials are injected and exfiltrated.
Affected products
| Product | Affected versions |
|---|---|
| Heym From 0.0.55 | before 0.0.121 |
Versions were read from the advisory text. No structured product data has been published for this record yet.