What is GHSA-7v8m-98rf-rgvw?

GHSA-7v8m-98rf-rgvw is a security advisory published by GitHub Security Advisories with Medium severity. Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former...

Which CVE IDs does GHSA-7v8m-98rf-rgvw cover?

GHSA-7v8m-98rf-rgvw covers the following CVE IDs: CVE-2026-109362. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7v8m-98rf-rgvw?

GHSA-7v8m-98rf-rgvw has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-7v8m-98rf-rgvwMediumCVSS 5.4

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former...

Vendor

GitHub Security Advisories

Published

October 12, 2026

Last Modified

October 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-109362 →

📋 Description

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.

🔗 References (4)

https://github.com/heymrun/heym/security/advisories/GHSA-pwr6-6377-3cgv
https://nvd.nist.gov/vuln/detail/CVE-2026-109362
https://www.vulncheck.com/advisories/heym-0.0.5-before-0.0.113-broken-access-control-via-workflow-execution-tokens
https://github.com/advisories/GHSA-7v8m-98rf-rgvw