Hermes WebUI before version 0.51.358 suffers from an improper access control flaw (CWE-306) that allows an unauthenticated attacker to set a password during the initial setup by sending the _set_password parameter to the /api/settings endpoint. This can result in the attacker obtaining a valid session cookie, taking over the account, and preventing the legitimate operator from accessing the instance.

The affected product is Hermes WebUI as distributed by nesquena. Any deployment running a version prior to 0.51.358 is vulnerable. The vulnerability applies to the settings API endpoint accessed during the first‑run configuration window.

The CVSS score of 9.2 indicates a high likelihood of significant impact if exploited. EPSS is not available, so the probability of exploitation cannot be quantified, but the vulnerability is listed in the CVE database and has no KEV listing yet, suggesting that exploitation is not yet widespread. Based on the description, the likely attack vector involves an unauthenticated attacker sending a POST request to /api/settings while the instance is in its initial‑setup state. Because there is no network origin restriction, this could be carried out remotely by any host that can reach the service.