CVE-2026-53871 describes an authorization bypass vulnerability in nesquena's hermes-webui prior to version 0.51.368. The issue stems from the get_profile_cookie() function accepting unauthenticated profile names from the hermes_profile cookie without validation or integrity checks. This allows an authenticated attacker to forge the cookie value, bypassing profile-scoped authorization controls and gaining unauthorized access to sessions, files, and resources belonging to other profiles.

The vulnerability allows an authenticated attacker to bypass profile-level authorization restrictions by forging the hermes_profile cookie. This can lead to unauthorized access to sessions, files, and resources across different user profiles, potentially exposing sensitive data and compromising user isolation within the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's communications for updates. In the meantime, consider restricting access to trusted users and environments and avoid relying solely on cookie values for authorization decisions.