CVE-2026-45226 describes an authorization bypass vulnerability in the heymrun heym product prior to version 0.0.21. The flaw allows authenticated users to execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation. Attackers can create workflows with execute nodes or agent subWorkflowIds pointing to victim workflow UUIDs, causing victim workflows to be loaded and executed under attacker-controlled execution paths. This can expose victim workflow outputs and trigger workflow nodes with unintended side effects. The vulnerability has a CVSS 4.0 base score of 7.6, indicating high severity. No official patch or remediation level has been published yet, and there are no known exploits in the wild.

An attacker with authenticated access can bypass authorization controls to execute arbitrary workflows belonging to other users. This can lead to exposure of sensitive workflow outputs and unintended triggering of workflow nodes, potentially causing side effects or unauthorized actions within the system. The vulnerability compromises workflow isolation and access control, impacting confidentiality and integrity of workflow executions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to minimize risk and monitor for suspicious workflow execution activity related to unauthorized UUID references.