{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/heym-0.0.55-0.120/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:heym:heym:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-110873"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Heym (0.0.55-0.120)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Heym"],"content_html":"\u003cp\u003eHeym versions 0.0.55 through 0.0.120 are affected by a privilege escalation vulnerability identified as CVE-2026-110873. The flaw stems from an improper validation mechanism where the error_workflow_id field is omitted from the OWNER_ONLY_EXECUTION_FIELDS list. This oversight permits shared collaborators, who typically possess restricted access, to modify the error handling configuration of a workflow. By redirecting the error workflow to an attacker-controlled workflow containing an HTTP node, the attacker can force the parent workflow to trigger an error. Upon execution of this error, the system injects the owner's decrypted credentials into the attacker's workflow, facilitating unauthorized credential exfiltration. This vulnerability presents a high risk for organizations using Heym for automated workflows involving sensitive service credentials.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthorized collaborators to escalate privileges and exfiltrate sensitive credentials associated with automated workflows. If exploited, an attacker can capture secrets stored within Heym, potentially compromising connected third-party services and downstream systems. The scope of impact is limited to environments where workflows are shared among collaborators with varying levels of trust.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Heym instance to version 0.0.121 or later to remediate CVE-2026-110873.\u003c/li\u003e\n\u003cli\u003eAudit existing workflow permissions and shared collaborator access levels within the Heym platform to identify workflows currently susceptible to modification by unauthorized users.\u003c/li\u003e\n\u003cli\u003eRotate any credentials or API keys that have been utilized within shared workflows where collaborator access has been granted during the period of vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T00:34:36Z","date_published":"2026-10-15T00:34:36Z","id":"https://feed.craftedsignal.io/briefs/2026-10-heym-priv-esc/","summary":"Heym versions 0.0.55 through 0.0.120 contain a privilege escalation vulnerability allowing shared collaborators to exfiltrate workflow credentials by overwriting error handlers.","title":"Privilege Escalation in Heym Workflow Execution","url":"https://feed.craftedsignal.io/briefs/2026-10-heym-priv-esc/"}],"language":"en","title":"CraftedSignal Threat Feed - Heym (0.0.55-0.120)","version":"https://jsonfeed.org/version/1.1"}