CVE-2026-55198 Details
Description
Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The _handle_session_export handler in api/routes.py fails to verify active-profile ownership before serializing session data, enabling attackers to exfiltrate foreign session transcripts by guessing or knowing session identifiers.
An authorization bypass vulnerability has been identified in Hermes WebUI versions prior to 0.51.443. This vulnerability exists in the session export endpoint, where the session data is not properly scoped to the active user profile. As a result, authenticated users can access and export session transcripts from other profiles by guessing or knowing the session identifiers. The vulnerability arises because the session export handler does not verify ownership of the session before exporting the data.
Users can update to Hermes WebUI version 0.51.443 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 17, 2026CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nesquena/hermes-webui/pull/3991 | CISA-ADP | Issue TrackingVendor |
| https://github.com/nesquena/hermes-webui/commit/2a3baa71b81ca92da8ece8616a09f15894beec71 | [email protected] | Source CodeVendor |
| https://github.com/nesquena/hermes-webui/pull/3991 | [email protected] | Issue TrackingVendor |
| https://github.com/nesquena/hermes-webui/pull/4269 | [email protected] | Issue TrackingVendor |
| https://github.com/nesquena/hermes-webui/releases/tag/v0.51.443 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/hermes-webui-cross-profile-session-data-exfiltration-via-session-export-endpoint | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hermes WebUI | < 0.51.443 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | [email protected] |
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |