Is CVE-2026-55198 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55198 being exploited in the wild.

How severe is CVE-2026-55198?

Medium severity, with a CVSS score of 6.5, published 17 June 2026.

Which products and versions are affected?

Nesquena Hermes WebUI < 0.51.443.

Is there a fix for CVE-2026-55198?

A patch was published on 2026-06-15: Fix merged and released in version 0.51.443 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55198 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55198?

Check whether you run Nesquena Hermes WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55198: nesquena Hermes WebUI authorization bypass in session export endpoint

Q: Is there a fix for CVE-2026-55198?

A patch was published on 2026-06-15: Fix merged and released in version 0.51.443 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55198 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55198?

Check whether you run Nesquena Hermes WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55198 · Severity: medium · CVSS 6.5 · Published 2026-06-17

Hermes WebUI, a tool for managing and viewing session data, contains a security flaw in its session export feature. An authorized user could potentially access and download session transcripts belonging to other user profiles if they know or can guess the specific session ID. This could lead to the unauthorized exposure of sensitive conversation content and metadata from different organizational profiles.

Technologies: Nesquena Hermes WebUI. Vendors: Nesquena.

Quick answers

Is CVE-2026-55198 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55198 being exploited in the wild.
How severe is CVE-2026-55198?: Medium severity, with a CVSS score of 6.5, published 17 June 2026.
Which products and versions are affected?: Nesquena Hermes WebUI < 0.51.443.
Is there a fix for CVE-2026-55198?: A patch was published on 2026-06-15: Fix merged and released in version 0.51.443 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55198 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55198?: Check whether you run Nesquena Hermes WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the `_handle_session_export` handler within `api/routes.py`. The endpoint fails to perform an ownership or profile-boundary check before serializing and streaming session data as JSON. An authenticated attacker with network access to the WebUI can exfiltrate session transcripts and metadata from foreign profiles by providing a target `session_id` to the `/api/session/export` endpoint. The vulnerability is addressed in version 0.51.443 by implementing the `_profiles_match` verification check before data serialization.

Affected products

nesquena hermes-webui < 0.51.443

Timeline

2026-06-11: other: Fix proposed in pull request #3991
2026-06-15: patched: Fix merged and released in version 0.51.443
2026-06-17: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.