---
id: "CVE-2026-67540"
page: "https://infrastack.ai/live/CVE-2026-67540"
kind: "vulnerability"
aliases: ["CVE-2026-67540"]
title: "Heym: any logged-in user reads other tenants' private workflow templates"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["agentic-workflows", "ai-tooling", "heym", "multi-tenant", "self-hosted"]
not_affected_if: ["single-user-instance", "version-0.0.70-or-later"]
published_at: "2026-11-11T22:17:28+00:00"
first_seen_at: "2026-11-11T22:29:34+00:00"
updated_at: "2026-11-11T22:34:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67540", "first_seen_at": "2026-11-11T22:29:34+00:00"}]
exploit_sources: []
---

# Heym: any logged-in user reads other tenants' private workflow templates

Link for people: https://infrastack.ai/live/CVE-2026-67540 (this .md is for agents)

Heym, a self-hosted platform for building agentic systems and business automations, lets any authenticated user fetch another tenant's private template by ID. The leak includes the template's full node and edge graph and the email addresses it was shared with.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Heym version with the instance's version endpoint or release tag; `unknown` if the sources do not say how to read it.
- Confirm whether the MCP/template get paths are reachable by ordinary users on your instance.

## Fix

- Move to Heym `0.0.70` or later, which the sources state patches this issue.

## Timeline

- 2026-11-11T22:29:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-67540

## Documents

- [advisory] Vendor advisory: github.com https://github.com/heymrun/heym/security/advisories/GHSA-5748-x76g-v68m
- [fix] Patch: github.com https://github.com/heymrun/heym/commit/4bcea469bfeee8c2659de90a1b2d16fdfed9ae97
- [fix] Release notes: github.com https://github.com/heymrun/heym/releases/tag/0.0.70

## From the sources

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, get_workflow_template / get_node_template fetches a template by ID with no visibility / author / shared_with predicate, so any authenticated user can read (and use) any other tenant's private (visibility=specific_users) template — including its full node/edge graph and the email addresses it was shared with. The list endpoint enforces visibility correctly; the single-item get/use paths do not. This issue has been patched in version 0.0.70.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_