CVE-2026-67540 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Heym, a self-hosted platform for building agentic systems and business automations, lets any authenticated user fetch another tenant's private template by ID. The leak includes the template's full node and edge graph and the email addresses it was shared with.
first public Jul 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running self-hosted Heym before version 0.0.70 with more than one user or tenant, since the flaw exposes templates to other authenticated users. The list endpoint enforces visibility correctly; the single-item get and use paths do not. Single-user instances with no other accounts are less exposed.
Not affected if single-user-instance, version-0.0.70-or-later
Who cares agentic-workflows, heym, multi-tenant, self-hosted
unknown if the sources do not say how to read it.0.0.70 or later, which the sources state patches this issue.Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, get_workflow_template / get_node_template fetches a template by ID with no visibility / author / shared_with predicate, so any authenticated user can read (and use) any other tenant's private (visibility=specific_users) template — including its full node/edge graph and the email addresses it was shared with. The list endpoint enforces visibility correctly; the single-item get/use paths do not. This issue has been patched in version 0.0.70.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.