Session Profile Bypass in Hermes WebUI

Executive Summary

CVE-2026-58174 is a security vulnerability in Hermes WebUI versions before 0.51.521 where imported sessions are not properly assigned to the active named profile during import. Instead, the session is created with a null profile, which the system treats as the default profile.

Because of this, a user operating under the default profile can export the imported session transcript and use its session identifier to access files from a named profile's workspace. This breaks the intended profile isolation and allows cross-profile information leaks.

The root cause is that the /api/session/import handler validates the workspace under the active profile but does not set the profile when constructing the Session object, leading to the session being persisted with a null profile.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves imported sessions being assigned a null profile, which is treated as the default profile, allowing cross-profile access. Detection would involve checking if imported sessions are improperly assigned to the default profile instead of the active named profile.

Since the issue occurs in the `/api/session/import` handler, monitoring or logging API calls to this endpoint and inspecting session objects for null or default profile assignments can help detect exploitation attempts.

No specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Hermes WebUI version 0.51.521 by ensuring imported sessions are assigned the active profile explicitly during import.

• Upgrade Hermes WebUI to version 0.51.521 or later to apply the fix.
• If upgrading immediately is not possible, restrict access to the `/api/session/import` endpoint to trusted users only.
• Monitor session imports and verify that sessions are correctly scoped to their profiles.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a user with access to the default profile to bypass profile isolation and access session data and files belonging to other named profiles.

Specifically, an attacker can export session transcripts and read files from another profile's workspace by exploiting the session identifier of an imported session that was incorrectly assigned to the default profile.

This leads to unauthorized disclosure of sensitive information across profile boundaries, compromising confidentiality.

Useful 0 Not Useful 0