Heym between version 0.0.55 and 0.0.120 contains a privilege escalation flaw that lets collaborators overwrite the workflow’s error_workflow_id field because it is not protected by the OWNER_ONLY_EXECUTION_FIELDS list. By setting the field to point to an attacker‑controlled workflow that includes an HTTP node, the parent workflow will inject the owner’s decrypted credentials into the injected workflow during error handling, resulting in credential theft.

The affected product is Heym from heymrun. All releases from 0.0.55 up through 0.0.120 inclusive are impacted. Versions 0.0.121 and later incorporate the fix, while earlier releases remain unaffected.

The CVSS score of 7.1 indicates moderate‑to‑high severity. EPSS data are not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires a collaborator with write access to a workflow and the ability to inject an external HTTP node, which is typically available only to project collaborators. Once the misconfigured field is exploited, the attacker gains access to the owner’s credentials, effectively compromising confidentiality and potentially allowing further lateral movement within the organization.