CVE-2026-55197 describes a broken access control vulnerability in nesquena's Hermes WebUI prior to version 0.51.443. The vulnerability exists in the /api/session endpoint, where authenticated users can bypass profile boundary checks by querying session IDs of other profiles using the GET /api/session?session_id=<foreign_id>&messages=1 request. This results in unauthorized access to session transcripts and associated metadata, violating access control policies.

An attacker with authenticated access can retrieve sensitive conversation transcripts and metadata from other user profiles without authorization. This leads to unauthorized disclosure of potentially sensitive information across profile boundaries. The CVSS 4.0 base score is 7.1 (high severity), reflecting network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict authenticated user access to trusted parties and consider additional access control measures to prevent unauthorized session ID queries.