The vulnerability in heymrun heym before version 0.0.21 involves improper authorization checks during workflow execution. Authenticated users can bypass access controls by crafting workflows that reference victim workflow UUIDs in execute nodes or agent subWorkflowIds. This causes the victim workflows to be loaded and executed under attacker-controlled execution paths, potentially exposing sensitive outputs and causing unintended workflow node side effects. The CVSS 4.0 vector indicates network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality and integrity.

An attacker with authenticated access but low privileges can execute arbitrary workflows belonging to other users without proper authorization. This may lead to exposure of sensitive workflow outputs and unintended triggering of workflow nodes, potentially disrupting normal operations or leaking confidential information. The vulnerability does not require user interaction but has high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to minimize exposure and monitor for unusual workflow executions. Avoid referencing untrusted workflow UUIDs in execute nodes or subWorkflowIds. Follow vendor updates closely for any forthcoming patches or official mitigations.