PT-2026-50520 · Nesquena · Hermes-Webui

Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-53871

Mitre

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get profile cookie() function that accepts unauthenticated profile names from the hermes profile cookie. An authenticated attacker can forge the hermes profile cookie value to bypass profile-scoped authorization checks and access sessions, files, and resources across different profiles.

Fix

Weakness Enumeration

CWE-565

Related Identifiers

CVE-2026-53871

Affected Products

Hermes-Webui

References · 5

• https://github.com/nesquena/hermes-webui/commit/9e96f5f6adf93b6d1e27ebddfb4d2833ca06ff3b · Patch
• https://github.com/nesquena/hermes-webui/pull/4036 · Note
• https://github.com/nesquena/hermes-webui/releases/tag/v0.51.368 · Note
• https://github.com/nesquena/hermes-webui/pull/4023 · Note
• https://vulncheck.com/advisories/hermes-webui-profile-scoped-authorization-bypass-via-forged-hermes-profile-cookie · Note