A security vulnerability was discovered in the Heym system prior to version 0.0.70. The issue allowed authenticated users with the lowest role to access the POST /api/mcp/fetch-tools endpoint, which could be used to fetch an attacker-supplied URL through the SSE and Streamable HTTP transports without any security restrictions. This allowed an attacker to perform a server-side request forgery (SSRF) attack, which can be used to access private IP addresses and potentially compromise the system. The vulnerability was patched in version 0.0.70, which restricts access to the endpoint to users with higher roles and adds security restrictions to prevent SSRF attacks.