Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by submitting the _set_password parameter to the settings API endpoint without any network origin restriction. Attackers on any reachable network can send a POST request to the settings endpoint during the first-run setup window to persist an arbitrary password hash, obtain a valid session cookie, and lock out the legitimate operator from their own instance.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-11 | 2 | Disclosure1Patch1 |
| 2026-06-12 | 1 | Disclosure1 |
🚨 CVE-2026-49973 — CVSS 9.4/10 █████████░ Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/OFO8fF8uw2
Post summary
A critical access-control flaw (CVE-2026-49973) in Hermes WebUI is disclosed with a CVSS of 9.4/10, and a patch is now available.
CVE-2026-49973 - Critical improper access control in Hermes WebUI. Unauthenticated attackers can hijack initial setup, set arbitrary password, lock out operators. CVSS 9.4. No patch yet - isolate affected systems immediately. #CVE #infosec #cybersecurity #linux https://www.valtersit.com/cve/CVE-2026-49973
Post summary
The post announces a critical access‑control flaw in Hermes WebUI that allows unauthenticated attackers to take over the setup and set passwords; no patch exists yet, so isolating affected systems is advised.
CVE-2026-49973 Unauthenticated Remote Access Control Bypass in Hermes WebUI Before 0.51.358 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49973
Post summary
CVE-2026-49973 is a newly disclosed unauthenticated remote access control bypass affecting Hermes WebUI versions prior to 0.51.358, with no known PoC, exploitation, or patch details provided in the text.