CVE-2026-67541

A team member could extend access to shared provider credentials

Heym · Heym team credential sharing

First documented disclosure · Review checkpoint

Summary

Membership changes lacked an administrator role check. Credential access followed team membership. Other accounts could gain access to provider keys or OAuth tokens shared with the team.

Severity and exploitation evidence

High · 8.1/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Membership changes lacked an administrator role check. Credential access followed team membership.

Conditions required

A signed-in user belonged to the affected team.

Potential impact

Other accounts could gain access to provider keys or OAuth tokens shared with the team.

Affected versions and configurations

Before 0.0.70.

Fix and mitigation status

The July advisory lists 0.0.58 in both affected and patched fields. The November CNA names 0.0.70 as corrected. Use 0.0.70 or later.

Practical next steps

Upgrade and review team membership and previously shared credentials.

Operating lesson

Apply authorization and isolation to every backend path that can act on behalf of an agent.

Evidence and limits

The July advisory lists 0.0.58 in both affected and patched fields. The November CNA names 0.0.70 as corrected. The public disclosure was on 2026-07-04. The CVE record was published on 2026-11-11.

Sources