Executive brief
Hermes WebUI is a web interface used to manage workspaces and sessions. A security flaw allowed sessions imported into a specific user profile to be incorrectly assigned to the 'default' profile. This could allow a user with access to the default profile to view sensitive session data and files belonging to other private profiles, potentially leading to unauthorized data exposure.
Technical details
A vulnerability exists in the /api/session/import handler of Hermes WebUI where the Session object is constructed without explicitly setting its profile attribute. While the workspace is validated against the active named profile, the resulting session is persisted with a null profile. Because the application's authorization logic treats a null profile as belonging to the 'default' or 'root' profile for legacy compatibility, an authenticated user operating under the default profile can export these sessions or use the session identifier to read files from the named profile's workspace. This effectively bypasses profile isolation. The issue is resolved in version 0.51.521 by ensuring the active profile name is stamped onto the Session object during import.
Affected products
- nesquena Hermes WebUI < 0.51.521
Timeline
- 2026-06-19: patched: Fix merged in PR #4506 and released in v0.51.521
- 2026-06-30: disclosed: CVE published and NVD entry created
References
- https://github.com/nesquena/hermes-webui/commit/3d5ef4758e920ba6888d49aaa4341de214693496
- https://github.com/nesquena/hermes-webui/pull/4489
- https://github.com/nesquena/hermes-webui/pull/4506
- https://github.com/nesquena/hermes-webui/releases/tag/v0.51.521
- https://www.vulncheck.com/advisories/hermes-webui-cross-profile-authorization-bypass-via-unset-session-profile-on-import