Vulnerability · Published Jun 9, 2026 · Assigned by VulnCheck

CVE-2026-49956Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search

Medium 6.5

In plain English

A medium-severity missing authorization in hermes-webui from nesquena. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 80.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Hermes WebUI before version 0.51.269 contains a profile isolation bypass vulnerability that allows authenticated users to access data belonging to other profiles by querying the session search endpoint without active-profile filtering. Attackers can send requests to the sessions search handler to retrieve session titles and transcript message content from profiles other than their own active profile.

Affected products (as reported)

Vendor	Product	Versions
nesquena	hermes-webui	0 – before 0.51.269

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/nesquena/hermes-webui/releases/tag/v0.51.269 release-notes
https://github.com/nesquena/hermes-webui/pull/3646 issue-tracking
https://github.com/nesquena/hermes-webui/pull/3672 issue-tracking
https://github.com/nesquena/hermes-webui/commit/2c7b530071bb29ae4184e83e33be5799d529568e patch
https://www.vulncheck.com/advisories/hermes-webui-profile-isolation-bypass-via-sessions-search third-party-advisory