CVE-2026-58174

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-58174

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58174.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-58174

Published

2026-06-30T15:55:54.374Z

Modified

2026-08-12T03:51:21.155411586Z

Severity

6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import

Details

Hermes WebUI before 0.51.521 validates the workspace of an imported session under the active named profile but constructs the Session object without setting its profile in the /api/session/import handler, so the imported session is persisted with a null profile. Because a null profile is treated as the default profile by the profile authorization check, a user on the default profile can export the imported session transcript and use its session identifier to read files from the named profile's workspace, defeating the application's profile isolation.

Database specific

{
    "cwe_ids": [
        "CWE-732"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58174.json",
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/nesquena/hermes-webui

Affected ranges

Type

GIT

Repo

https://github.com/nesquena/hermes-webui

Events

Introduced

Fixed

3d5ef4758e920ba6888d49aaa4341de214693496

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.51.521"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.12

v0.16

v0.16.1

v0.16.2

v0.17.1

v0.17.2

v0.17.3

v0.18

v0.18.1

v0.19

v0.20

v0.21

v0.22

v0.23

v0.24

v0.25

v0.26

v0.27

v0.28

v0.28.1

v0.29

v0.30

v0.30.1

v0.30.2

v0.30.3

v0.30.4

v0.31

v0.31.1

v0.31.2

v0.32

v0.33

v0.34

v0.34.1

v0.34.2

v0.34.3

v0.35

v0.35.1

v0.36

v0.36.1

v0.36.2

v0.36.3

v0.37.0

v0.38.0

v0.38.1

v0.38.2

v0.38.3

v0.38.4

v0.38.5

v0.38.6

v0.39.0

v0.39.1

v0.40.0

v0.40.1

v0.40.2

v0.41.0

v0.42.0

v0.42.1

v0.42.2

v0.43.0

v0.43.1

v0.44.0

v0.44.1

v0.45.0

v0.46.0

v0.47.0

v0.47.1

v0.48.0

v0.48.1

v0.48.2

v0.49.0

v0.49.1

v0.49.2

v0.49.3

v0.49.4

v0.50.0

v0.50.1

v0.50.10

v0.50.108

v0.50.109

v0.50.11

v0.50.110

v0.50.111

v0.50.112

v0.50.113

v0.50.114

v0.50.115

v0.50.116

v0.50.117

v0.50.118

v0.50.119

v0.50.12

v0.50.120

v0.50.121

v0.50.122

v0.50.123

v0.50.124

v0.50.125

v0.50.126

v0.50.127

v0.50.128

v0.50.129

v0.50.13

v0.50.130

v0.50.131

v0.50.132

v0.50.133

v0.50.134

v0.50.135

v0.50.136

v0.50.137

v0.50.138

v0.50.139

v0.50.14

v0.50.140

v0.50.141

v0.50.142

v0.50.143

v0.50.144

v0.50.145

v0.50.146

v0.50.147

v0.50.15

v0.50.150

v0.50.156

v0.50.157

v0.50.158

v0.50.159

v0.50.16

v0.50.160

v0.50.161

v0.50.162

v0.50.163

v0.50.164

v0.50.165

v0.50.166

v0.50.167

v0.50.168

v0.50.169

v0.50.17

v0.50.170

v0.50.171

v0.50.172

v0.50.173

v0.50.174

v0.50.175

v0.50.176

v0.50.177

v0.50.178

v0.50.179

v0.50.18

v0.50.180

v0.50.181

v0.50.182

v0.50.183

v0.50.184

v0.50.185

v0.50.186

v0.50.187

v0.50.188

v0.50.189

v0.50.19

v0.50.190

v0.50.191

v0.50.192

v0.50.193

v0.50.194

v0.50.195

v0.50.196

v0.50.197

v0.50.198

v0.50.199

v0.50.2

v0.50.20

v0.50.200

v0.50.202

v0.50.203

v0.50.204

v0.50.205

v0.50.206

v0.50.207

v0.50.208

v0.50.209

v0.50.21

v0.50.210

v0.50.211

v0.50.212

v0.50.214

v0.50.215

v0.50.216

v0.50.217

v0.50.218

v0.50.219

v0.50.22

v0.50.220

v0.50.221

v0.50.222

v0.50.223

v0.50.224

v0.50.225

v0.50.226

v0.50.227

v0.50.228

v0.50.229

v0.50.23

v0.50.230

v0.50.231

v0.50.232

v0.50.233

v0.50.235

v0.50.236

v0.50.237

v0.50.238

v0.50.239

v0.50.24

v0.50.240

v0.50.241

v0.50.242

v0.50.243

v0.50.244

v0.50.245

v0.50.246

v0.50.247

v0.50.248

v0.50.249

v0.50.25

v0.50.250

v0.50.251

v0.50.252

v0.50.253

v0.50.254

v0.50.255

v0.50.256

v0.50.257

v0.50.258

v0.50.259

v0.50.26

v0.50.260

v0.50.261

v0.50.262

v0.50.263

v0.50.264

v0.50.265

v0.50.266

v0.50.267

v0.50.268

v0.50.269

v0.50.27

v0.50.270

v0.50.271

v0.50.272

v0.50.273

v0.50.274

v0.50.275

v0.50.276

v0.50.277

v0.50.278

v0.50.279

v0.50.28

v0.50.280

v0.50.281

v0.50.282

v0.50.283

v0.50.284

v0.50.285

v0.50.286

v0.50.287

v0.50.288

v0.50.289

v0.50.29

v0.50.290

v0.50.291

v0.50.292

v0.50.293

v0.50.294

v0.50.295

v0.50.296

v0.50.297

v0.50.3

v0.50.30

v0.50.31

v0.50.32

v0.50.33

v0.50.34

v0.50.35

v0.50.36

v0.50.37

v0.50.38

v0.50.39

v0.50.4

v0.50.40

v0.50.41

v0.50.42

v0.50.43

v0.50.44

v0.50.45

v0.50.46

v0.50.47

v0.50.48

v0.50.49

v0.50.5

v0.50.50

v0.50.51

v0.50.52

v0.50.53

v0.50.54

v0.50.55

v0.50.56

v0.50.57

v0.50.58

v0.50.59

v0.50.6

v0.50.60

v0.50.61

v0.50.62

v0.50.63

v0.50.64

v0.50.67

v0.50.68

v0.50.69

v0.50.7

v0.50.70

v0.50.71

v0.50.72

v0.50.73

v0.50.74

v0.50.75

v0.50.76

v0.50.8

v0.50.82

v0.50.83

v0.50.84

v0.50.85

v0.50.86

v0.50.87

v0.50.88

v0.50.89

v0.50.9

v0.50.90

v0.50.91

v0.50.92

v0.50.93

v0.50.94

v0.50.95

v0.50.96

v0.51.0

v0.51.1

v0.51.10

v0.51.100

v0.51.101

v0.51.102

v0.51.103

v0.51.104

v0.51.105

v0.51.106

v0.51.107

v0.51.108

v0.51.109

v0.51.11

v0.51.110

v0.51.111

v0.51.112

v0.51.113

v0.51.114

v0.51.115

v0.51.116

v0.51.117

v0.51.118

v0.51.119

v0.51.12

v0.51.120

v0.51.121

v0.51.122

v0.51.123

v0.51.124

v0.51.125

v0.51.126

v0.51.127

v0.51.128

v0.51.129

v0.51.13

v0.51.130

v0.51.131

v0.51.132

v0.51.133

v0.51.134

v0.51.135

v0.51.136

v0.51.137

v0.51.138

v0.51.139

v0.51.14

v0.51.140

v0.51.141

v0.51.142

v0.51.143

v0.51.144

v0.51.145

v0.51.146

v0.51.147

v0.51.148

v0.51.149

v0.51.15

v0.51.150

v0.51.151

v0.51.152

v0.51.153

v0.51.154

v0.51.155

v0.51.156

v0.51.157

v0.51.158

v0.51.159

v0.51.16

v0.51.160

v0.51.161

v0.51.162

v0.51.163

v0.51.164

v0.51.165

v0.51.166

v0.51.167

v0.51.168

v0.51.169

v0.51.17

v0.51.170

v0.51.171

v0.51.172

v0.51.173

v0.51.174

v0.51.175

v0.51.176

v0.51.177

v0.51.178

v0.51.179

v0.51.18

v0.51.180

v0.51.181

v0.51.182

v0.51.183

v0.51.184

v0.51.185

v0.51.186

v0.51.187

v0.51.188

v0.51.189

v0.51.19

v0.51.190

v0.51.191

v0.51.192

v0.51.193

v0.51.194

v0.51.195

v0.51.196

v0.51.197

v0.51.198

v0.51.199

v0.51.2

v0.51.20

v0.51.200

v0.51.201

v0.51.202

v0.51.203

v0.51.204

v0.51.205

v0.51.206

v0.51.207

v0.51.208

v0.51.209

v0.51.21

v0.51.210

v0.51.211

v0.51.212

v0.51.213

v0.51.214

v0.51.215

v0.51.216

v0.51.217

v0.51.218

v0.51.219

v0.51.22

v0.51.220

v0.51.221

v0.51.222

v0.51.223

v0.51.224

v0.51.225

v0.51.226

v0.51.227

v0.51.228

v0.51.229

v0.51.23

v0.51.230

v0.51.231

v0.51.232

v0.51.233

v0.51.234

v0.51.235

v0.51.236

v0.51.237

v0.51.238

v0.51.239

v0.51.24

v0.51.240

v0.51.241

v0.51.242

v0.51.243

v0.51.244

v0.51.245

v0.51.246

v0.51.247

v0.51.248

v0.51.249

v0.51.25

v0.51.250

v0.51.251

v0.51.252

v0.51.253

v0.51.254

v0.51.255

v0.51.256

v0.51.257

v0.51.258

v0.51.259

v0.51.26

v0.51.260

v0.51.261

v0.51.262

v0.51.263

v0.51.264

v0.51.265

v0.51.266

v0.51.267

v0.51.268

v0.51.269

v0.51.27

v0.51.270

v0.51.271

v0.51.272

v0.51.273

v0.51.274

v0.51.275

v0.51.276

v0.51.277

v0.51.278

v0.51.279

v0.51.28

v0.51.280

v0.51.281

v0.51.282

v0.51.283

v0.51.284

v0.51.285

v0.51.286

v0.51.287

v0.51.288

v0.51.289

v0.51.29

v0.51.290

v0.51.291

v0.51.292

v0.51.293

v0.51.294

v0.51.295

v0.51.296

v0.51.297

v0.51.298

v0.51.299

v0.51.3

v0.51.30

v0.51.300

v0.51.301

v0.51.302

v0.51.303

v0.51.304

v0.51.305

v0.51.306

v0.51.307

v0.51.308

v0.51.309

v0.51.31

v0.51.310

v0.51.311

v0.51.312

v0.51.313

v0.51.314

v0.51.315

v0.51.316

v0.51.317

v0.51.318

v0.51.319

v0.51.32

v0.51.320

v0.51.321

v0.51.322

v0.51.323

v0.51.324

v0.51.325

v0.51.326

v0.51.327

v0.51.328

v0.51.329

v0.51.33

v0.51.330

v0.51.331

v0.51.332

v0.51.333

v0.51.334

v0.51.335

v0.51.336

v0.51.337

v0.51.338

v0.51.339

v0.51.34

v0.51.340

v0.51.341

v0.51.342

v0.51.343

v0.51.344

v0.51.345

v0.51.346

v0.51.347

v0.51.348

v0.51.349

v0.51.35

v0.51.350

v0.51.351

v0.51.352

v0.51.353

v0.51.354

v0.51.355

v0.51.356

v0.51.357

v0.51.358

v0.51.359

v0.51.36

v0.51.360

v0.51.361

v0.51.362

v0.51.363

v0.51.364

v0.51.365

v0.51.366

v0.51.367

v0.51.368

v0.51.369

v0.51.37

v0.51.370

v0.51.371

v0.51.372

v0.51.373

v0.51.374

v0.51.375

v0.51.376

v0.51.377

v0.51.378

v0.51.379

v0.51.38

v0.51.380

v0.51.381

v0.51.382

v0.51.383

v0.51.384

v0.51.385

v0.51.386

v0.51.387

v0.51.388

v0.51.389

v0.51.39

v0.51.390

v0.51.391

v0.51.392

v0.51.393

v0.51.394

v0.51.395

v0.51.396

v0.51.397

v0.51.398

v0.51.399

v0.51.4

v0.51.40

v0.51.400

v0.51.403

v0.51.404

v0.51.405

v0.51.406

v0.51.407

v0.51.408

v0.51.409

v0.51.41

v0.51.410

v0.51.411

v0.51.412

v0.51.413

v0.51.414

v0.51.415

v0.51.416

v0.51.417

v0.51.418

v0.51.419

v0.51.42

v0.51.420

v0.51.421

v0.51.422

v0.51.423

v0.51.424

v0.51.425

v0.51.426

v0.51.427

v0.51.428

v0.51.429

v0.51.43

v0.51.430

v0.51.431

v0.51.432

v0.51.433

v0.51.434

v0.51.435

v0.51.436

v0.51.437

v0.51.438

v0.51.439

v0.51.44

v0.51.440

v0.51.441

v0.51.442

v0.51.443

v0.51.444

v0.51.445

v0.51.446

v0.51.447

v0.51.448

v0.51.449

v0.51.45

v0.51.450

v0.51.451

v0.51.452

v0.51.453

v0.51.454

v0.51.455

v0.51.456

v0.51.457

v0.51.458

v0.51.459

v0.51.46

v0.51.460

v0.51.461

v0.51.462

v0.51.463

v0.51.464

v0.51.465

v0.51.466

v0.51.467

v0.51.468

v0.51.469

v0.51.47

v0.51.470

v0.51.471

v0.51.472

v0.51.473

v0.51.474

v0.51.475

v0.51.476

v0.51.477

v0.51.478

v0.51.479

v0.51.48

v0.51.480

v0.51.481

v0.51.482

v0.51.483

v0.51.484

v0.51.485

v0.51.486

v0.51.487

v0.51.488

v0.51.489

v0.51.49

v0.51.490

v0.51.491

v0.51.492

v0.51.493

v0.51.494

v0.51.495

v0.51.496

v0.51.497

v0.51.498

v0.51.499

v0.51.5

v0.51.50

v0.51.500

v0.51.501

v0.51.502

v0.51.503

v0.51.504

v0.51.505

v0.51.506

v0.51.507

v0.51.508

v0.51.509

v0.51.51

v0.51.510

v0.51.511

v0.51.512

v0.51.513

v0.51.514

v0.51.515

v0.51.516

v0.51.517

v0.51.518

v0.51.519

v0.51.52

v0.51.520

v0.51.53

v0.51.54

v0.51.55

v0.51.56

v0.51.57

v0.51.58

v0.51.59

v0.51.6

v0.51.60

v0.51.61

v0.51.62

v0.51.63

v0.51.64

v0.51.65

v0.51.66

v0.51.67

v0.51.68

v0.51.69

v0.51.7

v0.51.70

v0.51.71

v0.51.72

v0.51.73

v0.51.74

v0.51.75

v0.51.76

v0.51.77

v0.51.78

v0.51.79

v0.51.8

v0.51.80

v0.51.81

v0.51.82

v0.51.83

v0.51.84

v0.51.85

v0.51.86

v0.51.87

v0.51.88

v0.51.89

v0.51.9

v0.51.90

v0.51.91

v0.51.92

v0.51.93

v0.51.94

v0.51.95

v0.51.96

v0.51.97

v0.51.98

v0.51.99

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58174.json"