CVE-2026-49956: Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search
Hermes WebUI before version 0.51.269 contains a profile isolation bypass vulnerability that allows authenticated users to access data belonging to other profiles by querying the session search endpoint without active-profile filtering. Attackers can send requests to the sessions search handler to retrieve session titles and transcript message content from profiles other than their own active profile.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hermes WebUIto a version that resolves this vulnerability.Fixed in 0.51.269Patch Profile Isolation Bypass via sessions search
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49956?
CVE-2026-49956 has a medium severity score of 6.5.
How do I fix CVE-2026-49956?
To fix CVE-2026-49956, upgrade Hermes WebUI to version 0.51.269 or later.
What does CVE-2026-49956 exploit?
CVE-2026-49956 exploits a profile isolation bypass vulnerability through the sessions search endpoint.
Who is affected by CVE-2026-49956?
Authenticated users of Hermes WebUI versions prior to 0.51.269 are affected by CVE-2026-49956.
What are the potential impacts of CVE-2026-49956?
CVE-2026-49956 could allow authenticated users to access other users' profile data inappropriately.