CVE-2026-49973 describes an improper access control vulnerability in nesquena's Hermes WebUI before version 0.51.358. The flaw allows unauthenticated remote attackers to hijack the initial setup by sending a POST request with the _set_password parameter to the settings API endpoint without any network origin restrictions. This enables attackers on any reachable network to persist an arbitrary password hash, gain a valid session cookie, and lock out legitimate operators from their own instance during the first-run setup window.

An attacker can remotely hijack the initial setup process without authentication, set an arbitrary password, gain valid session credentials, and effectively lock out legitimate users from managing their Hermes WebUI instance. This compromises the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device during initial setup to trusted networks only to reduce exposure. Monitor for updates from the vendor regarding patches or official mitigations.