CVE-2026-67540 is a vulnerability in Heym, a system used for building and running agentic systems and business-process automations. Prior to version 0.0.70, authenticated users could access and use private workflow and node templates from other tenants by exploiting a lack of visibility and access control checks. This allowed unauthorized access to sensitive data, including full node/edge graphs and shared email addresses. The vulnerability has been patched in version 0.0.70, which enforces visibility and access controls correctly. This issue matters to people building or operating AI agents as it highlights the importance of robust access control and visibility checks in agentic systems to prevent unauthorized data access and potential security breaches.