PT-2026-50523 · Nesquena · Hermes-Webui

Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-55198

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The handle session export handler in api/routes.py fails to verify active-profile ownership before serializing session data, enabling attackers to exfiltrate foreign session transcripts by guessing or knowing session identifiers.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-55198

Affected Products

Hermes-Webui

References · 5

• 🔥 https://github.com/nesquena/hermes-webui/pull/3991 · Exploit
• https://github.com/nesquena/hermes-webui/commit/2a3baa71b81ca92da8ece8616a09f15894beec71 · Patch
• https://github.com/nesquena/hermes-webui/releases/tag/v0.51.443 · Note
• https://github.com/nesquena/hermes-webui/pull/4269 · Note
• https://vulncheck.com/advisories/hermes-webui-cross-profile-session-data-exfiltration-via-session-export-endpoint · Note