Vulnerability · Published Jun 17, 2026 · Assigned by VulnCheck

CVE-2026-55198Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in hermes-webui from nesquena. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 71.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The _handle_session_export handler in api/routes.py fails to verify active-profile ownership before serializing session data, enabling attackers to exfiltrate foreign session transcripts by guessing or knowing session identifiers.

Affected products (as reported)

Vendor	Product	Versions
nesquena	hermes-webui	0 – before 0.51.443

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

hermes-webui v0.51.443 Release Notes release-notes
Researcher Pull Request issue-tracking, patch
Maintainer Pull Request issue-tracking, patch
Patch Commit patch
https://www.vulncheck.com/advisories/hermes-webui-cross-profile-session-data-exfiltration-via-session-export-endpoint third-party-advisory