{"id":"CVE-2026-67540","kind":"vulnerability","aliases":["CVE-2026-67540"],"related":[],"title":"Heym: any logged-in user reads other tenants' private workflow templates","description":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, get_workflow_template / get_node_template fetches a template by ID with no visibility / author / shared_with predicate, so any authenticated user can read (and use) any other tenant's private (visibility=specific_users) template — including its full node/edge graph and the email addresses it was shared with. The list endpoint enforces visibility correctly; the single-item get/use paths do not. This issue has been patched in version 0.0.70.","summary":"Heym, a self-hosted platform for building agentic systems and business automations, lets any authenticated user fetch another tenant's private template by ID. The leak includes the template's full node and edge graph and the email addresses it was shared with.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agentic-workflows","ai-tooling","heym","multi-tenant","self-hosted"],"not_affected_if":["single-user-instance","version-0.0.70-or-later"],"how_to_check":"- Check the Heym version with the instance's version endpoint or release tag; `unknown` if the sources do not say how to read it.\n- Confirm whether the MCP/template get paths are reachable by ordinary users on your instance.","fix":"- Move to Heym `0.0.70` or later, which the sources state patches this issue.","status":"open","published_at":"2026-11-11T22:17:28+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","triaged_at":"2026-11-11T22:34:01+00:00","updated_at":"2026-11-11T22:34:01+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-11T22:34:01Z","model":"claude-haiku-5-5","output":{"fix":"- Move to Heym `0.0.70` or later, which the sources state patches this issue.","reach":"network","title":"Heym: any logged-in user reads other tenants' private workflow templates","impact":"medium","summary":"Heym, a self-hosted platform for building agentic systems and business automations, lets any authenticated user fetch another tenant's private template by ID. The leak includes the template's full node and edge graph and the email addresses it was shared with.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["heym","self-hosted","agentic-workflows","multi-tenant"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Other tenants' private workflow templates and shared emails readable","analyst_note":"","how_to_check":"- Check the Heym version with the instance's version endpoint or release tag; `unknown` if the sources do not say how to read it.\n- Confirm whether the MCP/template get paths are reachable by ordinary users on your instance.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.0.70-or-later","single-user-instance"],"who_is_affected":"Teams running self-hosted Heym before version 0.0.70 with more than one user or tenant, since the flaw exposes templates to other authenticated users. The list endpoint enforces visibility correctly; the single-item get and use paths do not. Single-user instances with no other accounts are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000737,"input_tokens":4665,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-67540':15A,18A '0.0.70':94C,164C 'address':71B,138C 'agent':20B,40B,79C 'agentic-workflow':19B 'ai':23B 'ai-tool':22B 'anoth':50B 'authent':47B,115C 'author':109C 'autom':44B,85C 'build':39B,76C 'busi':43B,83C 'business-process':82C 'correct':148C 'cve':13A,16A 'edg':66B 'email':70B,137C 'endpoint':145C 'enforc':146C 'fetch':49B,101C 'full':63B,132C 'get':95C,98C 'get/use':153C 'graph':67B,134C 'heym':1A,25B,32B,75C 'host':31B,36B,89C 'id':56B,105C 'includ':59B,130C 'infrastructur':90C 'issu':158C 'item':152C 'leak':58B 'let':45B 'list':144C 'log':4A 'logged-in':3A 'multi':27B 'multi-ten':26B 'node':64B,99C 'node/edge':133C 'patch':161C 'path':154C 'platform':37B 'predic':112C 'prior':91C 'privat':10A,53B,125C 'process':84C 'read':7A,118C 'run':78C 'self':30B,35B,88C 'self-host':29B,34B,87C 'share':74B,110C,141C 'singl':151C 'single-item':150C 'specif':127C 'system':41B,80C 'templat':12A,54B,61B,97C,100C,103C,129C 'tenant':9A,28B,51B,123C 'tool':24B 'use':120C 'user':6A,48B,116C,128C 'version':93C,163C 'visibl':108C,126C,147C 'workflow':11A,21B,96C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Heym before version 0.0.70 with more than one user or tenant, since the flaw exposes templates to other authenticated users. The list endpoint enforces visibility correctly; the single-item get and use paths do not. Single-user instances with no other accounts are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["agenticworkflows","aitooling","heym","medium","multitenant","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-67540':15A,18A 'cve':13A,16A 'heym':1A 'log':4A 'logged-in':3A 'privat':10A 'read':7A 'templat':12A 'tenant':9A 'user':6A 'workflow':11A","search_b":"'address':71B 'agent':20B,40B 'agentic-workflow':19B 'ai':23B 'ai-tool':22B 'anoth':50B 'authent':47B 'autom':44B 'build':39B 'busi':43B 'edg':66B 'email':70B 'fetch':49B 'full':63B 'graph':67B 'heym':25B,32B 'host':31B,36B 'id':56B 'includ':59B 'leak':58B 'let':45B 'multi':27B 'multi-ten':26B 'node':64B 'platform':37B 'privat':53B 'self':30B,35B 'self-host':29B,34B 'share':74B 'system':41B 'templat':54B,61B 'tenant':28B,51B 'tool':24B 'user':48B 'workflow':21B","search_c":"'0.0.70':94C,164C 'address':138C 'agent':79C 'authent':115C 'author':109C 'autom':85C 'build':76C 'busi':83C 'business-process':82C 'correct':148C 'email':137C 'endpoint':145C 'enforc':146C 'fetch':101C 'full':132C 'get':95C,98C 'get/use':153C 'graph':134C 'heym':75C 'host':89C 'id':105C 'includ':130C 'infrastructur':90C 'issu':158C 'item':152C 'list':144C 'node':99C 'node/edge':133C 'patch':161C 'path':154C 'predic':112C 'prior':91C 'privat':125C 'process':84C 'read':118C 'run':78C 'self':88C 'self-host':87C 'share':110C,141C 'singl':151C 'single-item':150C 'specif':127C 'system':80C 'templat':97C,100C,103C,129C 'tenant':123C 'use':120C 'user':116C,128C 'version':93C,163C 'visibl':108C,126C,147C 'workflow':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-04T11:01:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67540","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67540","severity":null,"published_at":"2026-11-11T22:17:28+00:00","modified_at":"2026-11-11T22:17:28+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","fetched_at":"2026-11-11T22:29:34+00:00","note":null}],"documents":[{"id":129431,"url":"https://github.com/heymrun/heym/commit/4bcea469bfeee8c2659de90a1b2d16fdfed9ae97","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129432,"url":"https://github.com/heymrun/heym/releases/tag/0.0.70","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129433,"url":"https://github.com/heymrun/heym/security/advisories/GHSA-5748-x76g-v68m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-04T11:01:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}