PT-2026-50522

Name of the Vulnerable Software and Affected Versions Hermes WebUI versions prior to 0.51.443 Description Broken access control in the '/api/session' endpoint allows authenticated users to disclose cross-profile session transcripts. By directly querying session IDs belonging to other profiles usi...