Which versions of Hermes WebUI are affected by CVE-2026-53871?

Hermes WebUI (versions before 0.51.368) contains an authorization bypass vulnerability that allows authenticated users to access confidential sessions, files, and resources belonging to other…. A patch is available.

How to fix or mitigate CVE-2026-53871?

Within 24 hours: Identify all Hermes WebUI deployments and confirm current version status; check access logs for suspicious cross-profile activity patterns. Within 7 days: Apply vendor patch by upgrading to Hermes WebUI version 0.51.368 or later across all instances; verify successful patch deployment. Within 30 days: Conduct forensic analysis of access logs spanning the vulnerability exposure period to identify unauthorized cross-profile access; implement enhanced profile-level access monitoring and controls.

Hermes WebUI CVE-2026-53871

Q: What is the CVSS score of CVE-2026-53871?

CVE-2026-53871 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

HIGH

Reliance on Cookies without Validation and Integrity Checking (CWE-565)

2026-06-17 VulnCheck

Authentication Bypass Hermes Webui

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable web UI, trivial cookie edit (AC:L), requires a valid account so PR:L; cross-profile read/write yields C:H/I:H but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 18:46 vuln.today

Analysis Generated

Jun 17, 2026 - 18:46 vuln.today

DescriptionCVE.org

Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie value to bypass profile-scoped authorization checks and access sessions, files, and resources across different profiles.

AnalysisAI

Cross-profile authorization bypass in Hermes WebUI before 0.51.368 allows authenticated users to access sessions, files, and resources belonging to other profiles by forging the hermes_profile cookie. The flaw lives in get_profile_cookie(), which trusted attacker-supplied profile names without binding them to the authenticated session. VulnCheck reported the issue and an upstream patch is available; no public exploit identified at time of analysis.

Technical ContextAI

Hermes WebUI (cpe:2.3:a:nesquena:hermes-webui) is a multi-profile web management interface where each user account can hold multiple isolated 'profiles' that scope access to sessions, files, and resources. The vulnerability is a CWE-565 issue (Reliance on Cookies without Validation and Integrity Checking): get_profile_cookie() reads the hermes_profile cookie and treats its value as an authoritative selector for which profile context to load, without verifying that the requesting session is actually authorized for the requested profile. Because the cookie is set client-side and never cross-checked against the server-side auth session, any logged-in user can swap in another profile's identifier and inherit that profile's authorization scope. The fix in PR #4023/#4036 (commit 9e96f5f) binds the active-profile cookie to the auth session, transforming the trust model from cookie-asserted to server-validated.

RemediationAI

Vendor-released patch: upgrade to Hermes WebUI 0.51.368 or later, which binds the active-profile cookie to the authenticated session (PRs https://github.com/nesquena/hermes-webui/pull/4023 and https://github.com/nesquena/hermes-webui/pull/4036, commit https://github.com/nesquena/hermes-webui/commit/9e96f5f6adf93b6d1e27ebddfb4d2833ca06ff3b). If immediate upgrade is not possible, restrict Hermes WebUI to single-profile users (so cross-profile escalation has no target) or front the application with a reverse proxy that strips or signs the hermes_profile cookie before it reaches the backend, accepting the trade-off that legitimate profile switching will break until proxy logic is taught to validate against the user's session. Revoke all existing sessions after patching, since attackers with prior access may have planted cookies or harvested cross-profile credentials, and audit access logs for anomalous profile transitions to detect prior exploitation.