An authentication vulnerability was discovered in the Heym system, allowing non-admin team members to add attacker accounts to teams, grant them access to credentials, and decrypt sensitive data such as API keys and OAuth tokens. This was possible due to a flawed access control mechanism that relied solely on team membership rather than the team creator/admin role. The vulnerability has been patched in version 0.0.70, which enforces stricter access controls and adds a role column to the TeamMember entity.