CVE-2026-58174: Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import
nesquena · hermes-webui
Fixed in 0.51.521 · Affected: nesquena hermes-webui before 0.51.521 · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 39% of scored CVEs
DescriptionCVE.org
Hermes WebUI before 0.51.521 validates the workspace of an imported session under the active named profile but constructs the Session object without setting its profile in the /api/session/import handler, so the imported session is persisted with a null profile. Because a null profile is treated as the default profile by the profile authorization check, a user on the default profile can export the imported session transcript and use its session identifier to read files from the named profile's workspace, defeating the application's profile isolation.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- nesquena · hermes-webuibefore 0.51.521
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
CoverageNo articles yet
No CyberSIXT article names CVE-2026-58174 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.