Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The _handle_session_export handler in api/routes.py fails to verify active-profile ownership before serializing session data, enabling attackers to exfiltrate foreign session transcripts by guessing or knowing session identifiers.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-17 | 1 | Disclosure1 |
| 2026-06-18 | 1 | General1 |
CVE-2026-55198 Authorization Bypass in Hermes WebUI Session Export Endpoint Before 0.51.443 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-55198
Post summary
A vulnerability (CVE-2026-55198) exposing an authorization bypass in Hermes WebUI’s session export endpoint before version 0.51.443 is reported, but no PoC, exploit, or patch details are provided.
CVE-2026-55198 Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from oth… https://www.cve.org/CVERecord?id=CVE-2026-55198
Post summary
The text announces an authorization bypass vulnerability in Hermes WebUI before version 0.51.443 that allows authenticated users to access sessions from other users.