Executive brief
Hermes WebUI, a tool for managing AI agent sessions and profiles, contains a security flaw where users can view conversation transcripts belonging to other profiles. By manually entering a session ID, an authenticated user can bypass the normal interface restrictions that usually keep different profiles separate. This could lead to the unauthorized disclosure of sensitive chat history and metadata from other users or organizational units.
Technical details
A broken access control vulnerability (CWE-639) exists in the /api/session endpoint of Hermes WebUI. While the main session list endpoint correctly filters results based on the user's active profile, the detail endpoint failed to perform a profile-matching check when a specific session_id was provided. An authenticated attacker with knowledge of a session ID belonging to a different profile could retrieve full conversation transcripts and metadata via a GET request to /api/session?session_id=<foreign_id>&messages=1. The vulnerability was addressed in version 0.51.443 by implementing the _profiles_match check on the detail and export routes.
Affected products
- nesquena hermes-webui < 0.51.443
Timeline
- 2026-06-11: other: Fix proposed in pull request #3982
- 2026-06-15: patched: Version 0.51.443 released
- 2026-06-17: disclosed: CVE-2026-55197 published
References
- https://github.com/nesquena/hermes-webui/commit/2a3baa71b81ca92da8ece8616a09f15894beec71
- https://github.com/nesquena/hermes-webui/pull/3982
- https://github.com/nesquena/hermes-webui/pull/4269
- https://github.com/nesquena/hermes-webui/releases/tag/v0.51.443
- https://www.vulncheck.com/advisories/hermes-webui-broken-access-control-in-api-session-endpoint