CVE-2026-55198: Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint
Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The handlesessionexport handler in api/routes.py fails to verify active-profile ownership before serializing session data, enabling attackers to exfiltrate foreign session transcripts by guessing or knowing session identifiers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hermes WebUIto a version that resolves this vulnerability.Fixed in 0.51.443 - Compensating control
Until upgraded, restrict access to the Hermes WebUI session export endpoint (/api/routes.py _handle_session_export) to authenticated users who should only access their own active profile, and deny access for requests where the caller cannot be verified to own the target profile/session transcript.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55198?
CVE-2026-55198 has a severity score of 7.1, indicating it is a high-risk vulnerability.
What does CVE-2026-55198 affect?
CVE-2026-55198 affects Hermes WebUI versions before 0.51.443.
How do I fix CVE-2026-55198?
To mitigate CVE-2026-55198, upgrade Hermes WebUI to version 0.51.443 or later.
What type of vulnerability is CVE-2026-55198?
CVE-2026-55198 is an authorization bypass vulnerability allowing access to sessions from other user profiles.
Who is impacted by CVE-2026-55198?
Authenticated users of Hermes WebUI prior to version 0.51.443 are impacted by CVE-2026-55198.