PT-2026-50522 · Nesquena · Hermes-Webui

Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-55197

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hermes WebUI versions prior to 0.51.443

Description Broken access control in the '/api/session' endpoint allows authenticated users to disclose cross-profile session transcripts. By directly querying session IDs belonging to other profiles using the GET '/api/session?session id=&messages=1' request, attackers can bypass profile boundary checks to retrieve unauthorized conversation transcripts and metadata via the session id variable.

Recommendations Update to version 0.51.443 or later. As a temporary workaround, restrict access to the '/api/session' endpoint to minimize the risk of unauthorized data disclosure.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-55197

Affected Products

Hermes-Webui

References · 6

• 🔥 https://github.com/nesquena/hermes-webui/pull/3982 · Exploit
• https://github.com/nesquena/hermes-webui/commit/2a3baa71b81ca92da8ece8616a09f15894beec71 · Patch
• https://github.com/nesquena/hermes-webui/pull/4269 · Note
• https://github.com/nesquena/hermes-webui/releases/tag/v0.51.443 · Note
• https://twitter.com/CVEnew/status/2067350993143013407 · Twitter Post
• https://vulncheck.com/advisories/hermes-webui-broken-access-control-in-api-session-endpoint · Note