CVE-2026-53871: Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie

Synopsis

This is an authorization bypass vulnerability in Hermes WebUI affecting versions before 0.51.368. An authenticated attacker can forge the hermes_profile cookie value to trick the get_profile_cookie() function into skipping profile-scoped authorization checks, gaining access to sessions, files, and resources belonging to other profiles. The attacker needs a low-privilege account to exploit this over the network; no further interaction is required. A patched-image rebuild at version 0.51.368 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Hermes WebUI service over the network; the CVSS vector specifies AV:N, meaning network exposure is sufficient and no physical or adjacent-network access is needed.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must be authenticated to the Hermes WebUI instance (PR:L), but no administrative or elevated privileges are required.

• Victim interactionNot required

  No victim interaction is needed; the attacker forges the cookie directly without requiring another user to click a link or take any action (UI:N).

• Attack complexityDetail

  Attack complexity is low (AC:L); exploitation is reliable and requires no race conditions, special memory layout, or environmental pre-conditions beyond holding a valid low-privilege session.

Blast Radius

• Attacker reads session tokens and private files belonging to other profiles within the Hermes WebUI instance.
• Attacker modifies or overwrites resources scoped to profiles they do not legitimately own.
• Attacker pivots across all profiles accessible to the server, effectively collapsing profile-level isolation for the entire deployment.