CVE-2026-110873

Executive Summary

CVE-2026-110873 is a privilege escalation vulnerability in Heym workflow automation software (versions 0.0.55 to 0.0.120). Shared collaborators can maliciously alter a workflow's error_workflow_id because the field is omitted from the OWNER_ONLY_EXECUTION_FIELDS access control list. This allows an attacker to redirect error handling to their own workflow, which can contain an HTTP node to exfiltrate the workflow owner's decrypted credentials when the parent workflow encounters an error. With a CVSS score of 7.1, this is a high-severity issue requiring immediate action: no patch is currently available (confidence 0/4), no public PoC exists, and EPSS has not scored it.

Technical Analysis

Heym is a workflow automation platform that executes user-defined workflows. Workflows can have shared collaborators who have limited privileges. The vulnerability lies in the access control mechanism that defines which workflow fields are restricted to the owner only. The OWNER_ONLY_EXECUTION_FIELDS list is intended to contain fields that only the workflow owner can modify, because they control critical execution behavior. The error_workflow_id field, which specifies a fallback workflow to execute if the parent workflow fails, was inadvertently omitted from this list. As a result, any collaborator with edit permissions can modify error_workflow_id.

When the parent workflow encounters an error, Heym automatically executes the workflow referenced by error_workflow_id. Because the error workflow runs in the context of the parent workflow, it may be granted access to the parent workflow's credentials. If the parent workflow's owner has stored encrypted credentials, Heym decrypts them for use during execution. An attacker can set error_workflow_id to point to a workflow they control, and that workflow can include an HTTP node that sends the decrypted credentials to an external server controlled by the attacker. The core vulnerability is CWE-863: Incorrect Authorization, specifically a missing field in an authorization list that should restrict modification to owners only.

The attack surface is the workflow collaboration feature. An attacker must have collaborator access to a workflow owned by another user or organization. The attack does not require any special privileges beyond that, and the CVSS vector indicates network access (AV:N), low complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), and scope unchanged (S:U). Impact includes high confidentiality loss (C:H), low integrity impact (I:L) because the attacker can only alter the error workflow field and cause execution of their own workflow, and no availability impact (A:N). The integrity impact is considered low because the attacker does not directly modify the parent workflow's behavior except through the error path.

Exploitation Scenarios

1) Reconnaissance/target identification: The attacker identifies a Heym instance (version 0.0.55 to 0.0.120) where they have collaborator access to at least one workflow owned by a victim. This could be a shared workflow in a multi-tenant environment or an internal deployment where roles are misconfigured.

2) Triggering the flaw class: The attacker, as a collaborator, modifies the error_workflow_id field of the victim's workflow. Since this field is missing from OWNER_ONLY_EXECUTION_FIELDS, the system allows the change despite the collaborator lacking owner privileges. The attacker sets this field to the ID of a workflow they control. This workflow must be reachable and executable by the Heym engine in the context of the victim's workflow.

3) Payload/execution method: The attacker's workflow contains an HTTP node configured to send an HTTP request to an external server under the attacker's control. When the victim's workflow later encounters an error (either naturally or triggered by the attacker through some action that causes a failure), Heym executes the attacker's workflow as the error handler. During this execution, Heym decrypts and injects the victim workflow owner's credentials into the execution context. The HTTP node in the attacker's workflow then transmits those credentials (e.g., in the request body or headers) to the attacker's server. No public PoC is available; the attack chain is inferred from the vulnerability class and the description provided.

4) Post-exploitation impact: The attacker obtains the victim's decrypted credentials. These credentials could grant access to other systems, data, or services. The confidentiality impact is high (C:H). The attacker could use these credentials to pivot, exfiltrate data, or escalate privileges further within the Heym instance or connected systems. The integrity impact is low (I:L) because the attacker's modification is limited to the error workflow field, though the credential theft could enable further attacks.

Impact Assessment

Business Impact: Organizations using Heym for workflow automation may suffer credential theft leading to unauthorized access to connected systems, data breaches, and potential lateral movement. The vulnerability affects the confidentiality of credentials stored in Heym, which could include API keys, database passwords, or cloud service credentials. This could result in financial loss, regulatory penalties, and reputational damage.

Affected Systems: Heym versions 0.0.55 through 0.0.120. Any deployment where workflows are shared with collaborators who are not fully trusted. Multi-tenant SaaS environments or internal installations with loose role assignments are at higher risk.

Blast Radius: The attacker can compromise any workflow owner's credentials for workflows they can collaborate on. If a single attacker gains collaborator access to multiple workflows, they can steal credentials from multiple owners. The CVSS score is 7.1 (High), with high confidentiality impact and low integrity impact. No availability impact. Exploitability is moderate due to the need for collaborator access, but once achieved, the attack is stealthy and effective.

Detection Guidance

Sigma Rule

title: Heym Privilege Escalation via error_workflow_id Modification
id: 8f9a2b1c-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects unauthorized modification of the error_workflow_id field by a non-owner collaborator in Heym workflows.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110873
author: Security Team
date: 2026-01-01
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: heym
  service: audit
detection:
  selection:
    event.action: "workflow.update"
    field.name: "error_workflow_id"
    actor.role: "collaborator"
  condition: selection
falsepositives:
  - Legitimate owner updates
level: high

YARA Rule

rule CVE_2026_110873_Heym_ErrorWorkflowID
{
    meta:
        description = "Detects Heym workflow definitions referencing error_workflow_id pointing to external workflows"
        author = "Security Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110873"
        severity = "high"
    strings:
        $error_field = "error_workflow_id" ascii wide nocase
        $http_node = "HTTP" ascii wide nocase
        $workflow = "workflow" ascii wide nocase
    condition:
        all of them
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-110873 Heym Credential Exfiltration via Error Workflow";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"error_workflow_id"; http_client_body;
    content:"http"; http_client_body;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
    reference:cve,2026-110873;
)

Elastic Detection

sequence by user.id with maxspan=5m
  [ audit where event.action == "workflow.update" and
    process.name == "heym" and
    user.roles != "owner" and
    workflow.field == "error_workflow_id" ]
  [ audit where event.action == "workflow.execute" and
    process.name == "heym" and
    workflow.trigger == "error" ]

Splunk SPL Query

index=heym_audit sourcetype=heym:workflow
| search "error_workflow_id" AND "update"
| rex field=_raw "user=(?<user>\S+)"
| rex field=_raw "role=(?<role>\S+)"
| where role!="owner"
| table _time, user, role, workflow_id, error_workflow_id
| sort - _time

Wazuh OSSEC Rule

<group name="heym,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">workflow.update</field>
    <field name="field.name">error_workflow_id</field>
    <field name="actor.role">collaborator</field>
    <description>CVE-2026-110873: Heym collaborator modified error_workflow_id - potential privilege escalation</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict collaborator permissions to only trusted users. Audit all collaborator roles and remove unnecessary access.
   • Monitor audit logs for changes to error_workflow_id by non-owners. Use the detection rules above.
   • If possible, disable the error workflow feature or restrict its configuration to owners only via custom access controls.
   • Review workflows for any suspicious error_workflow_id values that point to unknown or external workflows.
   • Rotate any credentials that may have been stored in workflows accessible to collaborators.

2. Patch/Upgrade Steps:

   • Upgrade Heym to version 0.0.121 or later. The fix adds error_workflow_id to OWNER_ONLY_EXECUTION_FIELDS, ensuring only owners can modify it.
   • After upgrade, verify that the field is properly restricted by testing with a non-owner account.
   • Apply the vendor's official patch as soon as it is released; monitor Heym's repository for updates.

3. Long-term Hardening:

   • Implement the principle of least privilege for all workflow collaborators.
   • Enforce strict separation of duties: owners control execution-critical fields.
   • Regularly audit workflow configurations for unauthorized changes.
   • Use secrets management solutions that do not expose credentials to workflow logic.
   • Conduct security reviews of all fields that affect execution context and ensure they are included in owner-only restrictions.

References

1. NVD — CVE-2026-110873: https://nvd.nist.gov/vuln/detail/CVE-2026-110873
2. Heym Project Repository (GitHub): https://github.com/heym/heym (returned 404 — verify manually) (check release 0.0.121)
3. CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
4. MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
5. Vendor advisory (if available): Consult Heym's official security advisories. No public exploit or threat actor campaign has been observed as of this report.