CVE-2026-109362

Heym versions v0.0.5 before v0.0.113 are susceptible to a broken access control vulnerability involving JWT-auth workflows . The root cause allows former collaborators to retain execution rights by reusing scoped workflow:execute tokens even after their access has been removed. Specifically, an a...