CVE-2026-49973
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by submitting the _set_password parameter to the settings API endpoint without any network origin restriction. Attackers on any reachable network can send a POST request to the settings endpoint during the first-run setup window to persist an arbitrary password hash, obtain a valid session cookie, and lock out the legitimate operator from their own instance.
Risk Assessment
The risk is a complete takeover of the Hermes WebUI instance by an unauthorized attacker, potentially leading to administrator lockout, data theft, or further attacks on the infrastructure.
Recommendation
Immediately upgrade Hermes WebUI to version 0.51.358 or later, which fixes this vulnerability. Additionally, restrict access to the settings API to trusted networks or implement authentication before initial setup.
Original NVD description (English source)
Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by submitting the _set_password parameter to the settings API endpoint without any network origin restriction. Attackers on any reachable network can send a POST request to the settings endpoint during the first-run setup window to persist an arbitrary password hash, obtain a valid session cookie, and lock out the legitimate operator from their own instance.