CVE-2026-55198: Hermes WebUI Authorization Bypass in Session Export

Technical summary

The _handle_session_export handler in api/routes.py implements insufficient authorization controls on the session export endpoint. While the endpoint requires authentication (PR:L), it does not validate that the requesting user's active profile matches the profile that owns the target session before serializing and returning session data. This authorization bypass is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). An attacker can enumerate or brute-force session identifiers to access and exfiltrate session transcripts from arbitrary profiles, with no requirement for user interaction.

Business impact

Organizations using Hermes WebUI to manage multi-user chat sessions face data confidentiality risks. Session transcripts may contain sensitive business information, customer communications, proprietary strategies, or personally identifiable information. The ability to export foreign sessions enables competitive intelligence gathering, compliance violations (e.g., unauthorized access to customer data), and reputational harm if transcripts are further shared. For compliance-heavy industries, unauthorized session access may trigger breach notification requirements and regulatory penalties.

Affected systems

All Hermes WebUI installations running versions prior to 0.51.443 are vulnerable. The vulnerability applies to any deployment where multiple user profiles access the WebUI and where session export functionality is enabled. Verify your installed version against the advisory from the Hermes project to confirm whether your deployment is in scope.

Exploitability

This vulnerability requires low attack complexity and authenticated access (a valid user account). Once authenticated, an attacker needs only to craft a request to the session export endpoint with a session identifier from another profile. No special privileges, system-level access, or user interaction is required beyond the initial authentication. The attack is straightforward to execute and can be automated to harvest multiple sessions in bulk.

Remediation

Upgrade Hermes WebUI to version 0.51.443 or later. This version includes authorization checks that enforce profile ownership validation in the session export handler. Before upgrading, audit logs to identify whether the export endpoint has been accessed by users to export sessions outside their own profiles. Coordinate the upgrade across all instances in your deployment and verify the fix is in place before resuming sensitive session operations.

Patch guidance

Apply the update to Hermes WebUI version 0.51.443 or newer as soon as feasible. The patch modifies the _handle_session_export handler to validate that the active profile of the requesting user matches the profile that owns the session before serialization. Test the patch in a non-production environment to confirm that session export functionality works correctly for authorized users and is properly blocked for cross-profile requests. Perform a rolling deployment if your environment supports zero-downtime updates.

Detection guidance

Monitor WebUI access logs and API request logs for repeated calls to the session export endpoint, particularly with varying session identifiers or from a single user account targeting multiple sessions in quick succession. Look for export requests that succeed despite the user not owning the requested session (cross-profile access). Enable detailed logging of authorization events and review authentication tokens and session identifiers in request payloads. Flag any anomalous patterns of session export activity before the 0.51.443 patch is deployed.

Why prioritize this

This vulnerability merits prompt but not emergency remediation. It requires valid authentication and results only in confidentiality loss (no integrity or availability impact), placing it at CVSS 6.5 (Medium). However, the ease of exploitation and the sensitive nature of session data (transcripts often contain strategic, customer, or personal information) warrant prioritization ahead of lower-severity issues. The lack of CISA KEV designation suggests limited current active exploitation, but the vulnerability is trivial to exploit once discovered, making proactive patching important before it becomes a known attack vector.

Risk score, explained

The CVSS 6.5 (Medium) score reflects a networked attack requiring prior authentication (reducing base risk) but with high confidentiality impact and low attack complexity once inside. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates that an authenticated attacker can confidentially compromise session data across network channels without user interaction. The score appropriately weights the balance between the need for valid credentials and the straightforward nature of the bypass.

Frequently asked questions