Heym lets any logged-in user run commands on the server

high severity · published 2026-11-11

An authenticated user with the lowest role can make Heym run any command they choose on the shared backend host, with the server's environment variables attached. The command executes even if it does not speak the MCP protocol.

CVE: CVE-2026-67546

Source: NVD

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2568 and your operating system.