Hermes WebUI versions prior to 0.51.269 expose a profile isolation bypass that allows an authenticated user to retrieve session titles and transcript content from profiles that are not the user’s active profile. The flaw is due to a missing authorization check on the session search endpoint, effectively granting users the ability to read information that should be restricted. This results in a confidentiality violation of other users’ data, consistent with CWE‑862 – Missing Authorization.

The affected product is Hermes WebUI, managed by the vendor nesquena. All installations running any release lower than 0.51.269 are vulnerable; versions 0.51.269 and later contain the fix.

The CVSS score of 7.1 indicates a medium‑to‑high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is application‑level over the network, as the attacker would send HTTP requests to the session search endpoint. Because the flaw is exploitable with normal authentication credentials and does not require elevated privileges, the risk to systems that allow multiple user profiles is significant, especially where sensitive session data is involved.