An authenticated user can request the session export endpoint to retrieve session data belonging to other user profiles. The vulnerability arises because the endpoint does not verify ownership of the requested session IDs before serializing the session data, allowing attackers to exfiltrate foreign session transcripts. This flaw enables the disclosure of potentially sensitive information, compromising confidentiality.

Hermes WebUI versions earlier than 0.51.443 are affected. The product is distributed by nesquena under the Hermes WebUI vendor name. Users running any version prior to the 0.51.443 release are at risk.

The CVSS score of 7.1 indicates a high impact, while the EPSS score of <1% suggests exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Attackers need only be authenticated to the system and must know or guess a valid session identifier. Once they have a session ID, the flaw permits unrestricted retrieval of that session’s data.