PT-2026-50523 · Unknown · Hermes-Webui

Hinotoi-Agent · CVE-2026-55198 · Published 2026-06-17 · Updated 2026-06-17

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Hermes WebUI versions prior to 0.51.443

Description An authorization bypass exists in the session export endpoint, allowing authenticated users to access sessions belonging to other profiles. The handle session export() function in 'api/routes.py' does not verify ownership of the active profile before serializing session data. This allows attackers to exfiltrate session transcripts from other users by knowing or guessing session identifiers.

Recommendations Update to version 0.51.443 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-55198

Affected Products

Hermes-Webui

References · 10

• 🔥 https://github.com/nesquena/hermes-webui/pull/3991 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55198.json · Exploit
• https://github.com/nesquena/hermes-webui/commit/2a3baa71b81ca92da8ece8616a09f15894beec71 · Patch
• https://osv.dev/vulnerability/CVE-2026-55198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-55198 · Security Note
• https://github.com/nesquena/hermes-webui · Note
• https://github.com/nesquena/hermes-webui/releases/tag/v0.51.443 · Note
• https://github.com/nesquena/hermes-webui/pull/4269 · Note
• https://vulncheck.com/advisories/hermes-webui-cross-profile-session-data-exfiltration-via-session-export-endpoint · Note
• https://twitter.com/CVEnew/status/2067350991612043757 · Twitter Post