CVE-2026-110873 Details
Description
Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner's decrypted credentials are injected and exfiltrated.
A privilege escalation vulnerability has been identified in Heym versions 0.0.55 prior to 0.0.121. This vulnerability allows shared collaborators to overwrite a workflow's error_workflow_id, as this field is not included in the OWNER_ONLY_EXECUTION_FIELDS. Attackers can redirect the error workflow to their own workflow using an HTTP node. When the parent workflow encounters an error, the owner's decrypted credentials are injected into the attacker's workflow and exfiltrated.
Users can update to Heym version 0.0.121 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/heymrun/heym/security/advisories/GHSA-c3f4-2mrj-jfqr | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/heym-0.0.55-before-0.0.121-credential-theft-via-error-workflow-id-field | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Heym | >= 0.0.55, < 0.0.121 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |