{"affected":[{"product":"heym","source":"CNA: GitHub_M","vendor":"heymrun","versions":[{"status":"affected","version":"< 0.0.70"}]}],"cveId":"CVE-2026-67541","cwes":["CWE-266","CWE-862"],"description":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, team-member management (add / remove / update) is gated only on team membership, not on the team creator/admin role — and TeamMember has no role column. Any non-creator member can seat an attacker account into the team; because credential team-shares are scoped only by TeamMember.user_id, the newly-added attacker can then decrypt every credential shared into that team (provider API keys, OAuth tokens. This issue has been patched in version 0.0.70.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.1,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794433142673,"publishedAt":1794433142673,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/heymrun/heym/security/advisories/GHSA-vxpw-x7j7-8723"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/heymrun/heym/commit/863e2702fca9a584246da9a51cca6b12828cebcf"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/heymrun/heym/commit/a9fc3d864e87fa2449b235798189db9cd39367c4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/heymrun/heym/commit/def26b5cf77dad4a9c5b5ff11c9863a0bc144ac8"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/heymrun/heym/releases/tag/0.0.70"}],"remediation":[],"revision":"53f1d4778e63ae4f0f446ea789b787df11251b7f6127f4591e3e6b2bdd8019fd","sources":[{"modifiedAt":1794433142673,"name":"CNA: GitHub_M","retrievedAt":1794435076711,"url":"https://www.cve.org/CVERecord?id=CVE-2026-67541"}],"ssvc":null,"status":"published","title":"Heym: Missing role gate in team-member management lets any member add/remove members, exposing team-shared credentials","updatedAt":1794435076711}