CVE-2026-45226: Heym Auth Bypass Vulnerability

CVE-2026-45226 Overview

CVE-2026-45226 is an authorization bypass vulnerability affecting Heym versions before 0.0.21. The flaw resides in workflow execution logic and allows authenticated users to invoke arbitrary workflows by referencing victim workflow UUIDs. The application loads referenced workflows without validating that the calling user has access rights. Attackers craft workflows containing execute nodes or agent subWorkflowIds pointing to victim UUIDs, causing those workflows to run under attacker-controlled paths. The vulnerability is classified under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated attackers can execute arbitrary victim workflows, exposing workflow outputs and triggering nodes with unintended side effects.

Affected Products

Heym versions prior to 0.0.21
Heym backend AI assistant module (backend/app/api/ai_assistant.py)
Heym backend MCP module (backend/app/api/mcp.py)

Discovery Timeline

2026-05-12 - CVE-2026-45226 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-45226

Vulnerability Analysis

The vulnerability stems from missing access validation in Heym's workflow reference resolution layer. When a workflow contains nodes that reference other workflows by UUID, the backend resolves and loads those workflows without verifying that the executing user owns or has been granted access to them. Attackers create their own workflow definition and embed an execute node or an agent node with a subWorkflowId pointing to a victim UUID. When the attacker triggers execution, Heym loads the victim workflow into the attacker's execution context. The victim workflow's nodes then run, returning outputs to the attacker and producing side effects such as external API calls, message sending, or data writes performed under the victim's defined credentials and configuration.

Root Cause

The function collect_referenced_workflows accepted only a database session and a list of nodes, with no parameter representing the acting user. Without an actor identity, the function could not enforce ownership or sharing checks when loading workflows referenced by UUID. This omission constitutes broken access control at the workflow loader boundary.

Attack Vector

An authenticated Heym user obtains or guesses a victim workflow UUID. The attacker creates a workflow that includes an execute node or an agent subWorkflowId field pointing to that UUID. Triggering the workflow through the AI assistant API or the MCP API causes the backend to resolve the reference and execute the victim's workflow. Network reachability to the Heym backend and valid authentication are the only required prerequisites.

python

# Patch applied in commit 3ae3ef6a7d3609da0e910f9ed6b81e99a1661ac8
# File: backend/app/api/ai_assistant.py
     if not workflow.nodes:
         return json.dumps({"status": "error", "error": "Workflow has no nodes"})
 
-    workflow_cache = await collect_referenced_workflows(db, workflow.nodes)
+    workflow_cache = await collect_referenced_workflows(db, workflow.nodes, actor_user_id=user_id)
     credentials_context = await get_credentials_context(db, user_id)
 
     enriched_inputs = {

Source: GitHub Commit 3ae3ef6

The fix introduces an actor_user_id argument so the loader can enforce per-user access checks before returning referenced workflows. The same change is applied in backend/app/api/mcp.py for MCP-driven execution paths.

Detection Methods for CVE-2026-45226

Indicators of Compromise

Workflow execution records where the executing user is not the owner of the resolved sub-workflow UUID.
Workflow definitions containing execute nodes or agent subWorkflowId fields that reference UUIDs owned by other tenants or users.
Unexpected outputs, webhook calls, or message sends originating from workflows that the recorded actor does not own.

Detection Strategies

Audit the workflow database for cross-user UUID references in execute nodes and subWorkflowIds, comparing node references against workflow ownership tables.
Review API access logs for ai_assistant and mcp endpoints, correlating invoking user IDs against the owner IDs of all transitively referenced workflows.
Inspect application logs for workflow load events that occurred without an actor_user_id argument, indicating pre-patch behavior.

Monitoring Recommendations

Alert on workflow execution traces where the actor_user_id differs from the owner of any loaded sub-workflow.
Track credentials usage volume per workflow to identify abnormal triggering patterns consistent with unauthorized invocation.
Forward Heym backend logs to a centralized analytics platform and apply correlation rules tying invoker identity to referenced UUID ownership.

How to Mitigate CVE-2026-45226

Immediate Actions Required

Upgrade Heym to version 0.0.21 or later, which includes the access check fix from pull request #93.
Rotate any credentials, API tokens, or webhook secrets stored in workflows that may have been triggered without authorization.
Audit existing workflows for cross-user UUID references and remove unauthorized embeddings.

Patch Information

The fix is delivered in Heym release v0.0.21 via pull request #93 and commit 3ae3ef6a7d3609da0e910f9ed6b81e99a1661ac8. The patch adds the actor_user_id parameter to collect_referenced_workflows so the loader enforces ownership checks. Refer to the VulnCheck advisory for additional vendor guidance.

Workarounds

Restrict Heym access to trusted authenticated users until the upgrade is applied.
Disable or remove workflows containing execute nodes and agent sub-workflow references that span user boundaries.
Monitor backend execution logs continuously and revoke API tokens belonging to any user suspected of issuing cross-tenant references.

bash

# Upgrade Heym to the patched release
pip install --upgrade heym==0.0.21

# Verify installed version
python -c "import heym; print(heym.__version__)"