Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2026-58174Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import

Medium 6.5

In plain English

A medium-severity incorrect permission assignment in hermes-webui from nesquena. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 60.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Hermes WebUI before 0.51.521 validates the workspace of an imported session under the active named profile but constructs the Session object without setting its profile in the /api/session/import handler, so the imported session is persisted with a null profile. Because a null profile is treated as the default profile by the profile authorization check, a user on the default profile can export the imported session transcript and use its session identifier to read files from the named profile's workspace, defeating the application's profile isolation.

Affected products (as reported)

Vendor	Product	Versions
nesquena	hermes-webui	0 – before 0.51.521

Weakness: CWE-732 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Release Notes release-notes
Researcher PR technical-description
Maintainer PR issue-tracking
Fix Commit patch
https://www.vulncheck.com/advisories/hermes-webui-cross-profile-authorization-bypass-via-unset-session-profile-on-import third-party-advisory