CVE-2026-55198
MediumCVSS 6.5Summary
Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The _handle_session_export handler in api/routes.py fails to verify active-profile ownership before serializing session data.
Risk Assessment
This vulnerability allows attackers to exfiltrate foreign session transcripts, potentially leading to privacy breaches and data security issues within the organization.
Recommendation
It is recommended to update Hermes WebUI to version 0.51.443 or later to mitigate this vulnerability and implement additional profile ownership verification mechanisms.
Original NVD description (English source)
Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The _handle_session_export handler in api/routes.py fails to verify active-profile ownership before serializing session data, enabling attackers to exfiltrate foreign session transcripts by guessing or knowing session identifiers.