2 matches found
CVE-2026-55197
Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other profiles via GET...
7.1CVSS5.8AI score0.00346EPSS
SaveExploits0References8
CVE-2026-55197: Authorization Bypass Through User-Controlled Key
Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other profiles via GET...
7.1CVSS5.8AI score0.00346EPSS
SaveExploits0References2
20