CVE-2026-110873

Deferred Deferred - Pending Action

Privilege Escalation in Heym Workflow

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner's decrypted credentials are injected and exfiltrated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110873

EUVD

EUVD-2026-101756

Affected Vendors & Products

Vendor	Product	Version / Range
heymrun	heym	0.0.55

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Heym versions 0.0.55 to 0.0.121 have a privilege escalation flaw where shared collaborators can overwrite a workflow's error_workflow_id field. This missing field in OWNER_ONLY_EXECUTION_FIELDS lets attackers redirect error workflows to their own malicious workflows. When the parent workflow fails, the owner's decrypted credentials are injected and exfiltrated via an HTTP node.

Detection Guidance

This vulnerability involves privilege escalation in Heym versions before 0.0.121 due to missing OWNER_ONLY_EXECUTION_FIELDS validation. Detection requires checking Heym versions and workflow configurations for unauthorized error_workflow_id modifications.

Impact Analysis

Attackers with shared access can steal sensitive credentials by triggering workflow errors. This leads to unauthorized data access, potential system compromise, and loss of confidential information. The impact includes credential theft and data breaches.

Compliance Impact

This vulnerability can lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face legal penalties, fines, and reputational damage due to non-compliance.

Mitigation Strategies

Update Heym to version 0.0.121 or later to address the privilege escalation vulnerability in the error_workflow_id field.

Hi! I’m here to help you understand CVE-2026-110873. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70