CVE-2026-110873: Incorrect Authorization in heymrun heym

CVE-2026-110873 is a privilege escalation vulnerability in heymrun's heym product affecting versions >=0.0.55 and <0.0.121. The vulnerability arises because the error_workflow_id field is not included in OWNER_ONLY_EXECUTION_FIELDS, allowing shared collaborators to overwrite it. By redirecting the error workflow to an attacker-controlled workflow with an HTTP node, attackers can cause the owner's decrypted credentials to be injected and exfiltrated when the parent workflow encounters an error.

An attacker with shared collaborator privileges can escalate their access by redirecting error workflows to attacker-controlled workflows, resulting in exposure and exfiltration of the owner's decrypted credentials. This compromises the confidentiality of sensitive credentials and potentially allows further unauthorized actions under the owner's identity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict shared collaborator privileges and monitor workflow configurations to prevent unauthorized modification of error_workflow_id fields.