What’s Vulnerable › Vulnerabilities

CVE-2026-58174: Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-30 · updated 2026-10-25
• Weakness: CWE-732

Description

Hermes WebUI before 0.51.521 validates the workspace of an imported session under the active named profile but constructs the Session object without setting its profile in the /api/session/import handler, so the imported session is persisted with a null profile. Because a null profile is treated as the default profile by the profile authorization check, a user on the default profile can export the imported session transcript and use its session identifier to read files from the named profile's workspace, defeating the application's profile isolation.

Affected products

• nesquena hermes-webui: before 0.51.521 — fixed in 0.51.521

How to fix

Upgrade to a fixed version: nesquena hermes-webui 0.51.521. Check the vendor advisory for mitigations.

References

• https://github.com/nesquena/hermes-webui/commit/3d5ef4758e920ba6888d49aaa4341de214693496
• https://github.com/nesquena/hermes-webui/pull/4489
• https://github.com/nesquena/hermes-webui/pull/4506
• https://github.com/nesquena/hermes-webui/releases/tag/v0.51.521
• https://www.vulncheck.com/advisories/hermes-webui-cross-profile-authorization-bypass-via-unset-session-profile-on-import
• https://github.com/nesquena/hermes-webui/pull/4489

Get alerted when CVE-2026-58174 or the next vulnerability affects your stack