CVE-2026-58174

Hermes WebUI before 0.51.521 validates the workspace of an imported session under the active named profile but constructs the Session object without setting its profile in the /api/session/import handler, so the imported session is persisted with a null profile. Because a null profile is treated as the default profile by the profile authorization check, a user on the default profile can export the imported session transcript and use its session identifier to read files from the named profile's workspace, defeating the application's profile isolation.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nesquena/hermes-webui/commit/3d5ef4758e920ba6888d49aaa4341de214693496
https://github.com/nesquena/hermes-webui/pull/4489
https://github.com/nesquena/hermes-webui/pull/4506
https://github.com/nesquena/hermes-webui/releases/tag/v0.51.521
https://www.vulncheck.com/advisories/hermes-webui-cross-profile-authorization-bypass-via-unset-session-profile-on-import
https://github.com/nesquena/hermes-webui/pull/4489

Configurations

No configuration.

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Hermes WebUI anterior a 0.51.521 valida el espacio de trabajo de una sesión importada bajo el perfil con nombre activo, pero construye el objeto de Sesión sin establecer su perfil en el gestor /API/session/import, por lo que la sesión importada se persiste con un perfil nulo. Debido a que un perfil nulo es tratado como el perfil predeterminado por la comprobación de autorización de perfil, un usuario con el perfil predeterminado puede exportar la transcripción de la sesión importada y usar su identificador de sesión para leer archivos del espacio de trabajo del perfil con nombre, lo que anula el aislamiento de perfiles de la aplicación.

Information

Published : 2026-06-30 17:16

Updated : 2026-10-25 21:10

NVD link : CVE-2026-58174

Mitre link : CVE-2026-58174

CVE.ORG link : CVE-2026-58174

JSON object : View

Products Affected

No product.

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2026-58174", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58174", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-30T16:47:14.661229Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/nesquena/hermes-webui", "vendor": "nesquena", "product": "hermes-webui", "versions": [{"status": "affected", "version": "0", "lessThan": "0.51.521", "versionType": "semver"}], "packageURL": "pkg:github/nesquena/hermes-webui", "defaultStatus": "unaffected"}]}], "published": "2026-06-30T17:16:24.573", "references": [{"url": "https://github.com/nesquena/hermes-webui/commit/3d5ef4758e920ba6888d49aaa4341de214693496", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/nesquena/hermes-webui/pull/4489", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/nesquena/hermes-webui/pull/4506", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/nesquena/hermes-webui/releases/tag/v0.51.521", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/hermes-webui-cross-profile-authorization-bypass-via-unset-session-profile-on-import", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/nesquena/hermes-webui/pull/4489", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Hermes WebUI before 0.51.521 validates the workspace of an imported session under the active named profile but constructs the Session object without setting its profile in the /api/session/import handler, so the imported session is persisted with a null profile. Because a null profile is treated as the default profile by the profile authorization check, a user on the default profile can export the imported session transcript and use its session identifier to read files from the named profile's workspace, defeating the application's profile isolation."}, {"lang": "es", "value": "Hermes WebUI anterior a 0.51.521 valida el espacio de trabajo de una sesi\u00f3n importada bajo el perfil con nombre activo, pero construye el objeto de Sesi\u00f3n sin establecer su perfil en el gestor /API/session/import, por lo que la sesi\u00f3n importada se persiste con un perfil nulo. Debido a que un perfil nulo es tratado como el perfil predeterminado por la comprobaci\u00f3n de autorizaci\u00f3n de perfil, un usuario con el perfil predeterminado puede exportar la transcripci\u00f3n de la sesi\u00f3n importada y usar su identificador de sesi\u00f3n para leer archivos del espacio de trabajo del perfil con nombre, lo que anula el aislamiento de perfiles de la aplicaci\u00f3n."}], "lastModified": "2026-10-25T21:10:00.770", "sourceIdentifier": "disclosure@vulncheck.com"}