THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-55198 (MEDIUM 6.5) — Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The _handle_session_export handler in api/routes.py fails to verify active-profile ownership before s

[NVD] CVE-2026-55198 (MEDIUM 6.5) — Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The _handle_session_export handler in api/routes.py fails to verify active-profile ownership before s

lownvdPublished 2026-06-17

CVE-2026-55198 CVSS: 6.5 MEDIUM Published: 2026-06-17T19:18:13.480

Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The _handle_session_export handler in api/routes.py fails to verify active-profile ownership before serializing session data, enabling attackers to exfil

Indicators of compromise

CVE-2026-55198cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-55198