# CVE-2026-49973: nesquena Hermes WebUI improper access control in settings API

Source: https://junglewise.ai/threats/cve-2026-49973-nesquena-hermes-webui-improper-access-control-in-settings-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-49973 · Severity: critical · CVSS 9.4 · Published 2026-06-11

Hermes WebUI, a web-based management interface, contains a security flaw in its initial setup process. When the software is first installed and has no password configured, an unauthorized person on the network can remotely set their own password before the legitimate owner does. This allows an attacker to take full control of the interface and lock out the intended administrator.

## Quick answers

**Is CVE-2026-49973 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49973 being exploited in the wild.

**How severe is CVE-2026-49973?** Critical severity, with a CVSS score of 9.4, published 11 June 2026.

**Which products and versions are affected?** nesquena Hermes WebUI < 0.51.358.

**Is there a fix for CVE-2026-49973?** A patch was published on 2026-06-10: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49973 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-49973?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper access control vulnerability exists in the `POST /api/settings` endpoint of Hermes WebUI. When the application is in its initial "no-password" state, the settings API remains reachable without authentication to facilitate setup. However, the endpoint failed to restrict the `_set_password` parameter to local or private network origins. An unauthenticated remote attacker can submit a password hash to this endpoint, which persists the new credentials, establishes ownership, and issues a valid session cookie to the attacker. This effectively locks out the legitimate administrator. The vulnerability is resolved in version 0.51.358 by gating first-run password bootstrap to loopback/private networks unless explicitly overridden by the `HERMES_WEBUI_ONBOARDING_OPEN` environment variable.

## Affected products

- nesquena Hermes WebUI < 0.51.358

## Timeline

- 2026-06-10: patched: Fix committed to repository
- 2026-06-11: advisory: NVD and vendor advisory published

## References

- [https://github.com/nesquena/hermes-webui/commit/1126e541325d401538f6a272a9c024c37d47ae08](https://github.com/nesquena/hermes-webui/commit/1126e541325d401538f6a272a9c024c37d47ae08)
- [https://github.com/nesquena/hermes-webui/pull/3964](https://github.com/nesquena/hermes-webui/pull/3964)
- [https://github.com/nesquena/hermes-webui/pull/3973](https://github.com/nesquena/hermes-webui/pull/3973)
- [https://github.com/nesquena/hermes-webui/releases/tag/v0.51.358](https://github.com/nesquena/hermes-webui/releases/tag/v0.51.358)
- [https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-password-takeover-via-api-settings](https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-password-takeover-via-api-settings)