PT-2026-47854 · Nesquena · Hermes-Webui

Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-49956

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Hermes WebUI before version 0.51.269 contains a profile isolation bypass vulnerability that allows authenticated users to access data belonging to other profiles by querying the session search endpoint without active-profile filtering. Attackers can send requests to the sessions search handler to retrieve session titles and transcript message content from profiles other than their own active profile.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-49956

Affected Products

Hermes-Webui

References · 6

• https://github.com/nesquena/hermes-webui/commit/2c7b530071bb29ae4184e83e33be5799d529568e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-49956 · Security Note
• https://github.com/nesquena/hermes-webui/pull/3672 · Note
• https://github.com/nesquena/hermes-webui/releases/tag/v0.51.269 · Note
• https://vulncheck.com/advisories/hermes-webui-profile-isolation-bypass-via-sessions-search · Note
• https://github.com/nesquena/hermes-webui/pull/3646 · Note