CVE-2026-109362 heymrun CVE debrief

Who should care

Defenders responsible for Heym deployments should assess exposure and prioritize upgrading to version 0.0.113 or later. They should review and revoke any existing workflow execution tokens and monitor for suspicious workflow execution activity. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should care about CVE-2026-109362 because it allows former collaborators to execute workflows using reused tokens, potentially leading to unauthorized access and data breaches.

• Former collaborators may continue executing workflows using reused tokens
• Tokens can be minted with a TTL up to 10 years
• Owner cannot list or revoke tokens

Technical summary

The vulnerability allows former collaborators to execute JWT-auth workflows by reusing scoped workflow:execute tokens after share removal, potentially leading to unauthorized access and data breaches. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke. The vulnerability is in Heym v0.0.5 before v0.0.113. Defenders should prioritize verifying and upgrading to version 0.0.113 or later. The source item provides additional context on the vulnerability, including its potential impact and recommended actions.

Defensive priority

Defenders should prioritize verifying and upgrading to version 0.0.113 or later.

Recommended defensive actions

• Verify and upgrade to version 0.0.113 or later
• Review and revoke any existing workflow execution tokens
• Monitor for suspicious workflow execution activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the broken access control vulnerability in Heym v0.0.5 before v0.0.113. The vulnerability allows former collaborators to execute JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke. Defenders should verify and upgrade to version 0.0.113 or later. The source item provides additional context on the vulnerability, including its potential impact and recommended actions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.