{"id":"CVE-2026-55197","summary":"Hermes WebUI \u003c 0.51.443 - Broken Access Control in /api/session Endpoint","details":"Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other profiles via GET /api/session?session_id=\u003cforeign_id\u003e&messages=1 to retrieve unauthorized conversation transcripts and metadata.","modified":"2026-07-08T08:13:45.415093394Z","published":"2026-06-17T17:59:10.933Z","database_specific":{"cwe_ids":["CWE-639"],"cna_assigner":"VulnCheck","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55197.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55197.json"},{"type":"ADVISORY","url":"https://github.com/nesquena/hermes-webui/releases/tag/v0.51.443"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55197"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/hermes-webui-broken-access-control-in-api-session-endpoint"},{"type":"REPORT","url":"https://github.com/nesquena/hermes-webui/pull/3982"},{"type":"REPORT","url":"https://github.com/nesquena/hermes-webui/pull/4269"},{"type":"FIX","url":"https://github.com/nesquena/hermes-webui/commit/2a3baa71b81ca92da8ece8616a09f15894beec71"},{"type":"PACKAGE","url":"https://github.com/nesquena/hermes-webui"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nesquena/hermes-webui","events":[{"introduced":"0"},{"fixed":"2a3baa71b81ca92da8ece8616a09f15894beec71"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.51.443"}],"source":["AFFECTED_FIELD","DESCRIPTION","REFERENCES"]}}],"versions":["v0.51.442","v0.51.441","v0.51.440","v0.51.439","v0.51.438","v0.51.437","v0.51.436","v0.51.435","v0.51.434","v0.51.433","v0.51.432","v0.51.426","v0.51.431","v0.51.430","v0.51.429","v0.51.428","v0.51.427","v0.51.425","v0.51.424","v0.51.423","v0.51.422","v0.51.421","v0.51.420","v0.51.419","v0.51.418","v0.51.417","v0.51.416","v0.51.415","v0.51.414","v0.51.413","v0.51.412","v0.51.411","v0.51.410","v0.51.409","v0.51.408","v0.51.407","v0.51.406","v0.51.405","v0.51.404","v0.51.403","v0.51.400","v0.51.399","v0.51.398","v0.51.397","v0.51.396","v0.51.395","v0.51.394","v0.51.393","v0.51.392","v0.51.391","v0.51.390","v0.51.389","v0.51.388","v0.51.387","v0.51.386","v0.51.385","v0.51.384","v0.51.383","v0.51.382","v0.51.381","v0.51.380","v0.51.379","v0.51.378","v0.51.377","v0.51.376","v0.51.375","v0.51.374","v0.51.373","v0.51.372","v0.51.371","v0.51.370","v0.51.369","v0.51.368","v0.51.367","v0.51.366","v0.51.365","v0.51.359","v0.51.364","v0.51.363","v0.51.362","v0.51.361","v0.51.360","v0.51.326","v0.51.358","v0.51.357","v0.51.356","v0.51.355","v0.51.354","v0.51.353","v0.51.352","v0.51.351","v0.51.350","v0.51.349","v0.51.341","v0.51.348","v0.51.347","v0.51.346","v0.51.345","v0.51.344","v0.51.343","v0.51.342","v0.51.340","v0.51.339","v0.51.338","v0.51.337","v0.51.336","v0.51.335","v0.51.334","v0.51.333","v0.51.332","v0.51.331","v0.51.330","v0.51.329","v0.51.328","v0.51.327","v0.51.325","v0.51.324","v0.51.323","v0.51.322","v0.51.321","v0.51.320","v0.51.319","v0.51.318","v0.51.317","v0.51.316","v0.51.315","v0.51.314","v0.51.313","v0.51.312","v0.51.311","v0.51.310","v0.51.309","v0.51.308","v0.51.307","v0.51.306","v0.51.305","v0.51.304","v0.51.303","v0.51.302","v0.51.301","v0.51.300","v0.51.299","v0.51.298","v0.51.297","v0.51.296","v0.51.295","v0.51.294","v0.51.293","v0.51.292","v0.51.291","v0.51.290","v0.51.289","v0.51.288","v0.51.287","v0.51.286","v0.51.285","v0.51.284","v0.51.283","v0.51.282","v0.51.281","v0.51.280","v0.51.279","v0.51.278","v0.51.277","v0.51.276","v0.51.275","v0.51.274","v0.51.273","v0.51.272","v0.51.271","v0.51.270","v0.51.269","v0.51.268","v0.51.267","v0.51.266","v0.51.265","v0.51.264","v0.51.263","v0.51.262","v0.51.261","v0.51.260","v0.51.259","v0.51.258","v0.51.257","v0.51.256","v0.51.255","v0.51.254","v0.51.253","v0.51.252","v0.51.251","v0.51.250","v0.51.249","v0.51.248","v0.51.247","v0.51.246","v0.51.245","v0.51.244","v0.51.243","v0.51.242","v0.51.241","v0.51.240","v0.51.239","v0.51.238","v0.51.237","v0.51.236","v0.51.235","v0.51.234","v0.51.233","v0.51.232","v0.51.231","v0.51.230","v0.51.229","v0.51.228","v0.51.227","v0.51.226","v0.51.225","v0.51.224","v0.51.223","v0.51.222","v0.51.221","v0.51.220","v0.51.219","v0.51.218","v0.51.217","v0.51.216","v0.51.215","v0.51.214","v0.51.213","v0.51.212","v0.51.211","v0.51.210","v0.51.209","v0.51.208","v0.51.207","v0.51.206","v0.51.205","v0.51.204","v0.51.203","v0.51.202","v0.51.201","v0.51.200","v0.51.199","v0.51.198","v0.51.197","v0.51.196","v0.51.195","v0.51.194","v0.51.193","v0.51.192","v0.51.191","v0.51.190","v0.51.189","v0.51.188","v0.51.187","v0.51.186","v0.51.185","v0.51.184","v0.51.182","v0.51.157","v0.51.183","v0.51.181","v0.51.180","v0.51.179","v0.51.178","v0.51.177","v0.51.176","v0.51.175","v0.51.174","v0.51.173","v0.51.172","v0.51.171","v0.51.169","v0.51.170","v0.51.168","v0.51.167","v0.51.166","v0.51.165","v0.51.164","v0.51.163","v0.51.162","v0.51.161","v0.51.160","v0.51.159","v0.51.158","v0.51.156","v0.51.155","v0.51.154","v0.51.153","v0.51.152","v0.51.145","v0.51.151","v0.51.150","v0.51.149","v0.51.148","v0.51.147","v0.51.146","v0.51.141","v0.51.144","v0.51.143","v0.51.142","v0.51.139","v0.51.140","v0.51.138","v0.51.137","v0.51.136","v0.51.135","v0.51.134","v0.51.133","v0.51.132","v0.51.131","v0.51.130","v0.51.129","v0.51.128","v0.51.127","v0.51.126","v0.51.125","v0.51.124","v0.51.123","v0.51.122","v0.51.121","v0.51.120","v0.51.119","v0.51.118","v0.51.117","v0.51.116","v0.51.115","v0.51.114","v0.51.113","v0.51.112","v0.51.111","v0.51.110","v0.51.109","v0.51.108","v0.51.107","v0.51.106","v0.51.105","v0.51.104","v0.51.103","v0.51.102","v0.51.101","v0.51.100","v0.51.99","v0.51.98","v0.51.97","v0.51.96","v0.51.95","v0.51.94","v0.51.93","v0.51.92","v0.51.91","v0.51.90","v0.51.89","v0.51.88","v0.51.87","v0.51.86","v0.51.85","v0.51.84","v0.51.83","v0.51.82","v0.51.61","v0.51.81","v0.51.80","v0.51.79","v0.51.78","v0.51.77","v0.51.76","v0.51.75","v0.51.74","v0.51.73","v0.51.72","v0.51.71","v0.51.70","v0.51.69","v0.51.68","v0.51.67","v0.51.66","v0.51.65","v0.51.64","v0.51.63","v0.51.62","v0.51.60","v0.51.59","v0.51.58","v0.51.57","v0.51.54","v0.51.56","v0.51.55","v0.51.52","v0.51.53","v0.51.50","v0.51.51","v0.51.34","v0.51.49","v0.51.48","v0.51.47","v0.51.46","v0.51.45","v0.50.278","v0.51.44","v0.51.43","v0.51.42","v0.51.41","v0.51.40","v0.51.39","v0.51.38","v0.51.37","v0.51.36","v0.51.35","v0.51.31","v0.51.33","v0.51.32","v0.51.30","v0.51.29","v0.51.28","v0.51.27","v0.51.26","v0.51.25","v0.51.24","v0.51.23","v0.51.22","v0.51.21","v0.51.20","v0.51.19","v0.51.18","v0.51.17","v0.51.16","v0.51.15","v0.51.14","v0.51.13","v0.51.12","v0.51.11","v0.51.10","v0.51.9","v0.51.8","v0.51.7","v0.51.6","v0.51.5","v0.51.4","v0.51.3","v0.51.2","v0.51.1","v0.51.0","v0.50.297","v0.50.296","v0.50.295","v0.50.294","v0.50.293","v0.50.292","v0.50.291","v0.50.290","v0.50.289","v0.50.288","v0.50.287","v0.50.286","v0.50.285","v0.50.284","v0.50.283","v0.50.282","v0.50.281","v0.50.280","v0.50.279","v0.50.277","v0.50.276","v0.50.275","v0.50.274","v0.50.273","v0.50.272","v0.50.271","v0.50.270","v0.50.269","v0.50.268","v0.50.267","v0.50.266","v0.50.265","v0.50.263","v0.50.264","v0.50.261","v0.50.262","v0.50.260","v0.50.259","v0.50.258","v0.50.257","v0.50.256","v0.50.255","v0.50.254","v0.50.253","v0.50.252","v0.50.251","v0.50.250","v0.50.249","v0.50.248","v0.50.247","v0.50.246","v0.50.245","v0.50.244","v0.50.243","v0.50.242","v0.50.241","v0.50.240","v0.50.239","v0.50.238","v0.50.237","v0.50.236","v0.50.235","v0.50.233","v0.50.232","v0.50.231","v0.50.230","v0.50.229","v0.50.228","v0.50.227","v0.50.226","v0.50.225","v0.50.224","v0.50.223","v0.50.222","v0.50.221","v0.50.220","v0.50.219","v0.50.218","v0.50.217","v0.50.216","v0.50.215","v0.50.214","v0.50.212","v0.50.211","v0.50.210","v0.50.209","v0.50.208","v0.50.207","v0.50.206","v0.50.205","v0.50.204","v0.50.203","v0.50.202","v0.50.200","v0.50.199","v0.50.198","v0.50.197","v0.50.196","v0.50.195","v0.50.194","v0.50.193","v0.50.192","v0.50.191","v0.50.190","v0.50.189","v0.50.188","v0.50.187","v0.50.186","v0.50.185","v0.50.184","v0.50.183","v0.50.182","v0.50.181","v0.50.180","v0.50.179","v0.50.178","v0.50.177","v0.50.176","v0.50.175","v0.50.174","v0.50.173","v0.50.172","v0.50.171","v0.50.170","v0.50.169","v0.50.168","v0.50.167","v0.50.166","v0.50.165","v0.50.164","v0.50.163","v0.50.162","v0.50.161","v0.50.160","v0.50.159","v0.50.158","v0.50.157","v0.50.156","v0.50.150","v0.50.147","v0.50.146","v0.50.145","v0.50.144","v0.50.143","v0.50.142","v0.50.141","v0.50.140","v0.50.139","v0.50.138","v0.50.137","v0.50.136","v0.50.135","v0.50.134","v0.50.133","v0.50.132","v0.50.131","v0.50.130","v0.50.129","v0.50.128","v0.50.127","v0.50.126","v0.50.125","v0.50.124","v0.50.123","v0.50.122","v0.50.121","v0.50.120","v0.50.119","v0.50.118","v0.50.117","v0.50.116","v0.50.115","v0.50.114","v0.50.113","v0.50.112","v0.50.111","v0.50.110","v0.50.109","v0.50.108","v0.50.96","v0.50.95","v0.50.94","v0.50.93","v0.50.92","v0.50.91","v0.50.90","v0.50.89","v0.50.88","v0.50.87","v0.50.86","v0.50.85","v0.50.84","v0.50.83","v0.50.82","v0.50.76","v0.50.75","v0.50.74","v0.50.73","v0.50.72","v0.50.71","v0.50.70","v0.50.69","v0.50.68","v0.50.67","v0.50.64","v0.50.63","v0.50.62","v0.50.61","v0.50.60","v0.50.59","v0.50.58","v0.50.57","v0.50.56","v0.50.55","v0.50.54","v0.50.53","v0.50.52","v0.50.51","v0.50.50","v0.50.49","v0.50.48","v0.50.47","v0.50.46","v0.50.45","v0.50.44","v0.50.43","v0.50.42","v0.50.41","v0.50.40","v0.50.39","v0.50.38","v0.50.37","v0.50.36","v0.50.35","v0.50.34","v0.50.33","v0.50.32","v0.50.31","v0.50.30","v0.50.29","v0.50.28","v0.50.27","v0.50.26","v0.50.25","v0.50.24","v0.50.23","v0.50.22","v0.50.21","v0.50.20","v0.50.19","v0.50.18","v0.50.17","v0.50.16","v0.50.15","v0.50.14","v0.50.13","v0.50.12","v0.50.11","v0.50.10","v0.50.9","v0.50.8","v0.50.7","v0.50.6","v0.50.5","v0.50.4","v0.50.3","v0.50.2","v0.50.1","v0.50.0","v0.49.4","v0.49.3","v0.49.2","v0.49.1","v0.49.0","v0.48.2","v0.48.1","v0.48.0","v0.47.1","v0.47.0","v0.46.0","v0.45.0","v0.44.1","v0.44.0","v0.43.1","v0.43.0","v0.42.2","v0.42.1","v0.42.0","v0.41.0","v0.40.2","v0.40.1","v0.40.0","v0.39.1","v0.39.0","v0.38.6","v0.38.5","v0.38.4","v0.38.3","v0.38.2","v0.38.1","v0.38.0","v0.37.0","v0.36.3","v0.36.2","v0.36.1","v0.36","v0.35.1","v0.35","v0.34.3","v0.34.2","v0.34.1","v0.34","v0.33","v0.32","v0.31.2","v0.31.1","v0.31","v0.30.4","v0.30.3","v0.30.2","v0.30.1","v0.30","v0.29","v0.28.1","v0.28","v0.27","v0.26","v0.25","v0.24","v0.23","v0.22","v0.21","v0.20","v0.19","v0.18.1","v0.18","v0.17.3","v0.17.2","v0.17.1","v0.16.2","v0.16.1","v0.16","v0.12"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55197.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}