CVE-2026-55197
Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint
CVSS 4.0 7.1 HIGHCVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-55197
PublishedHermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other profiles via GET /api/session?session_id=<foreign_id>&messages=1 to retrieve unauthorized conversation transcripts and metadata.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-55197 · CVE overview and exploitation status
cve-program · CVE-2026-55197
- https://github.com/nesquena/hermes-webui/releases/tag/v0.51.443
- https://github.com/nesquena/hermes-webui/pull/3982
- https://github.com/nesquena/hermes-webui/pull/4269
- https://github.com/nesquena/hermes-webui/commit/2a3baa71b81ca92da8ece8616a09f15894beec71
- https://www.vulncheck.com/advisories/hermes-webui-broken-access-control-in-api-session-endpoint
Related changes
Linked by CVE identifierNo related changes are available here.