CVE-2026-55198 is an authorization bypass vulnerability in nesquena's Hermes WebUI prior to version 0.51.443. The issue exists in the _handle_session_export handler within api/routes.py, which fails to verify that the active profile owns the session before serializing and exporting session data. As a result, authenticated users can access session transcripts belonging to other profiles by guessing or knowing session identifiers, leading to unauthorized data exposure.

An attacker with authenticated access can bypass authorization controls to access session data from other users' profiles. This exposure of session transcripts could lead to leakage of sensitive information contained in those sessions. The vulnerability does not require user interaction and has a low attack complexity, increasing the risk of exploitation if session identifiers are predictable or obtainable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor for vendor updates addressing this issue. Until a fix is available, restrict access to the session export endpoint to trusted users only and consider implementing additional access controls or monitoring for suspicious access patterns related to session exports.