Hermes WebUI versions prior to 0.51.521 validate the workspace of an imported session against the active named profile, but the /api/session/import handler constructs the Session object without assigning a profile. The resulting session is persisted with a null profile, and the application treats a null profile as the default profile during authorization checks. Consequently, a user with only default‑profile access can import a session belonging to a higher‑privilege named profile, export its transcript, and use the session identifier to read files from that other profile’s workspace, thereby bypassing intended profile isolation.

The issue affects the Hermes WebUI application from nesquena, specifically all releases older than version 0.51.521. The vulnerable component is the session import endpoint, /api/session/import, which processes imported session data.

The CVSS score of 6.0 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that public exploitation data is limited. An attacker would need to be authenticated to the system and must be able to access the /api/session/import endpoint, which is typically available to all authenticated users. While the description does not explicitly state the availability of this endpoint, it is inferred that the endpoint is accessible once a user is authenticated. Once the import is performed, the attacker can export the session transcript and use the session identifier to read files from a named profile’s workspace, thereby achieving unauthorized file access across profiles.