CVE-2026-55197 is a broken access control vulnerability in nesquena's Hermes WebUI before version 0.51.443. The flaw exists in the /api/session endpoint, where authenticated users can bypass profile boundary checks by querying session IDs of other profiles using the GET /api/session?session_id=<foreign_id>&messages=1 request. This results in unauthorized access to session transcripts and associated metadata from other user profiles. The vulnerability has a CVSS 4.0 score of 7.1, indicating high severity, with network attack vector, low attack complexity, and no privileges required beyond authentication.

An attacker with valid authentication can retrieve sensitive conversation transcripts and metadata from other user profiles, violating confidentiality and potentially exposing private information. This cross-profile data disclosure can lead to privacy breaches and unauthorized information exposure within the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 0.51.443, upgrading to version 0.51.443 or later may address the issue if an official fix is released. Until then, restrict access to the /api/session endpoint and monitor for suspicious activity involving session_id parameters.