CVE-2026-55198 describes an authorization bypass vulnerability in nesquena's Hermes WebUI before version 0.51.443. The vulnerability exists in the _handle_session_export handler within api/routes.py, which fails to verify that the active profile owns the session being exported. As a result, authenticated users with low privileges can access session data belonging to other profiles by supplying session identifiers they guess or know. This leads to unauthorized disclosure of session transcripts.

The vulnerability allows authenticated users to bypass authorization controls and access session data from other user profiles. This unauthorized access can lead to exposure of sensitive session transcripts, potentially compromising user privacy and confidentiality. The CVSS 4.0 base score is 7.1 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.

No official fix or patch has been confirmed yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the session export endpoint to trusted users only and monitor for suspicious access patterns involving session identifiers. Avoid sharing session identifiers publicly or insecurely.