CVE-2026-49956

Hermes WebUI before version 0.51.269 contains a profile isolation bypass vulnerability that allows authenticated users to access data belonging to other profiles by querying the session search endpoint without active-profile filtering. Attackers can send requests to the sessions search handler to retrieve session titles and transcript message content from profiles other than their own active profile.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nesquena/hermes-webui/commit/2c7b530071bb29ae4184e83e33be5799d529568e
https://github.com/nesquena/hermes-webui/pull/3646
https://github.com/nesquena/hermes-webui/pull/3672
https://github.com/nesquena/hermes-webui/releases/tag/v0.51.269
https://www.vulncheck.com/advisories/hermes-webui-profile-isolation-bypass-via-sessions-search
https://github.com/nesquena/hermes-webui/pull/3646

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-09 17:17

Updated : 2026-07-23 08:10

NVD link : CVE-2026-49956

Mitre link : CVE-2026-49956

CVE.ORG link : CVE-2026-49956

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-49956", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49956", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T17:50:27.441317Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/nesquena/hermes-webui", "vendor": "nesquena", "product": "hermes-webui", "versions": [{"status": "affected", "version": "0", "lessThan": "0.51.269", "versionType": "semver"}], "packageURL": "pkg:github/nesquena/hermes-webui", "defaultStatus": "affected"}]}], "published": "2026-06-09T17:17:48.943", "references": [{"url": "https://github.com/nesquena/hermes-webui/commit/2c7b530071bb29ae4184e83e33be5799d529568e", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/nesquena/hermes-webui/pull/3646", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/nesquena/hermes-webui/pull/3672", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/nesquena/hermes-webui/releases/tag/v0.51.269", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/hermes-webui-profile-isolation-bypass-via-sessions-search", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/nesquena/hermes-webui/pull/3646", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Hermes WebUI before version 0.51.269 contains a profile isolation bypass vulnerability that allows authenticated users to access data belonging to other profiles by querying the session search endpoint without active-profile filtering. Attackers can send requests to the sessions search handler to retrieve session titles and transcript message content from profiles other than their own active profile."}, {"lang": "es", "value": "Hermes WebUI antes de la versi\u00f3n 0.51.269 contiene una vulnerabilidad de omisi\u00f3n de aislamiento de perfil que permite a usuarios autenticados acceder a datos pertenecientes a otros perfiles al consultar el endpoint de b\u00fasqueda de sesiones sin filtrado por perfil activo. Los atacantes pueden enviar solicitudes al gestor de b\u00fasqueda de sesiones para recuperar t\u00edtulos de sesi\u00f3n y contenido de mensajes de transcripci\u00f3n de perfiles distintos de su propio perfil activo."}], "lastModified": "2026-07-23T08:10:00.137", "sourceIdentifier": "disclosure@vulncheck.com"}