CVE-2026-58174: nesquena Hermes WebUI authorization bypass in session import

CVE-2026-58174 · Severity: medium · CVSS 6.5 · Published 2026-06-30

Hermes WebUI is a web interface used to manage workspaces and sessions. A security flaw allowed sessions imported into a specific user profile to be incorrectly assigned to the 'default' profile. This could allow a user with access to the default profile to view sensitive session data and files belonging to other private profiles, potentially leading to unauthorized data exposure.

Technologies: Nesquena Hermes WebUI. Vendors: Nesquena.

Quick answers

Is CVE-2026-58174 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58174 being exploited in the wild.
How severe is CVE-2026-58174?
Medium severity, with a CVSS score of 6.5, published 30 June 2026.
Which products and versions are affected?
Nesquena Hermes WebUI < 0.51.521.
Is there a fix for CVE-2026-58174?
A patch was published on 2026-06-19: Fix merged in PR #4506 and released in v0.51.521 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58174 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-58174?
Check whether you run Nesquena Hermes WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the /api/session/import handler of Hermes WebUI where the Session object is constructed without explicitly setting its profile attribute. While the workspace is validated against the active named profile, the resulting session is persisted with a null profile. Because the application's authorization logic treats a null profile as belonging to the 'default' or 'root' profile for legacy compatibility, an authenticated user operating under the default profile can export these sessions or use the session identifier to read files from the named profile's workspace. This effectively bypasses profile isolation. The issue is resolved in version 0.51.521 by ensuring the active profile name is stamped onto the Session object during import.

Affected products

  • nesquena Hermes WebUI < 0.51.521

Timeline

  • 2026-06-19: patched: Fix merged in PR #4506 and released in v0.51.521
  • 2026-06-30: disclosed: CVE published and NVD entry created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.