Executive brief
Heym, an automation and workflow platform, contains a security flaw where users can bypass access controls to run workflows belonging to other people. By creating a custom workflow that references a victim's unique workflow ID, an attacker can force the system to execute that private workflow and view its results. This could lead to the exposure of sensitive data or the unauthorized triggering of automated actions, such as sending messages or modifying files, that the victim had configured.
Technical details
An authorization bypass exists in Heym's workflow execution engine due to insufficient access validation when resolving sub-workflows. While the system correctly validates access to the 'root' workflow, it fails to verify that the actor has permissions for workflows referenced via 'execute' nodes or agent 'subWorkflowIds'. An authenticated attacker who knows or guesses a victim's workflow UUID can embed it into their own workflow; the backend will then load and execute the victim's workflow into the attacker's execution path. This allows the attacker to capture the output of the victim's workflow or trigger its side effects. The vulnerability was addressed in version 0.0.21 by enforcing access checks during the workflow caching process.
Affected products
- heymrun Heym before 0.0.21
Timeline
- 2026-05-10: patched: Fix merged via PR #93
- 2026-05-12: advisory: CVE published