Dashboard / CVE-2026-49956

CVE-2026-49956

HIGH
MEDIUM Priority: 0.02 BB Relevance: 64/100
Published: 2026-06-09 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: High
VI: None
VA: None

Description

Hermes WebUI before version 0.51.269 contains a profile isolation bypass vulnerability that allows authenticated users to access data belonging to other profiles by querying the session search endpoint without active-profile filtering. Attackers can send requests to the sessions search handler to retrieve session titles and transcript message content from profiles other than their own active profile.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
nesquena hermes-webui 0 < 0.51.269

References & Advisories (5)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.27%
Raw Score 0.002720
Percentile 19.8%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00272
2026-11-12
0.00272
2026-11-10
0.00272
2026-11-09
0.00272
2026-11-08
0.00272

Intelligence Sources

mitre ref →

External Links