---
id: CVE-2026-49973
title: Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings
summary: >-
  Hermes WebUI before version 0.51.358 contains an improper access control
  vulnerability that allows unauthenticated remote attackers to hijack initial
  setup by submitting the _set_password parameter to the settings API endpoint
  without an…
severity: critical
cvss: 9.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-306
vendor: nesquena
product: hermes-webui
affected:
  - hermes-webui < 0.51.358
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-06-13T02:37:13.947916Z'
exploitAvailable: true
published: '2026-06-11'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:05:00.824Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-49973'
references:
  - url: 'https://github.com/nesquena/hermes-webui/releases/tag/v0.51.358'
    label: hermes-webui 0.51.358 Release Notes
  - url: 'https://github.com/nesquena/hermes-webui/pull/3964'
  - url: 'https://github.com/nesquena/hermes-webui/pull/3973'
  - url: >-
      https://github.com/nesquena/hermes-webui/commit/1126e541325d401538f6a272a9c024c37d47ae08
  - url: >-
      https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-password-takeover-via-api-settings
tags:
  - cve.org
  - exploit-available
epss: 0.00543
epssPercentile: 0.45894
ingestedAt: '2026-11-08T14:51:22.380Z'
---

## Overview

Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by submitting the _set_password parameter to the settings API endpoint without any network origin restriction. Attackers on any reachable network can send a POST request to the settings endpoint during the first-run setup window to persist an arbitrary password hash, obtain a valid session cookie, and lock out the legitimate operator from their own instance.

## Affected

- `hermes-webui < 0.51.358`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.