CVE-2026-104198
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
ZoneMinder versions 1.34.0 through 1.36.38 mishandles failed token authentication in web/includes/auth.php. validateToken() returns false for a malformed or invalidly signed token, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped.
Risk Assessment
This can dispatch views that rely on the outer authentication gate, including the zones view, which discloses monitor and zone metadata without an independent permission check. Unauthorized state changes have not been established, as permission helpers deny privileged operations for the false user value.
Recommendation
Update ZoneMinder to version 1.36.63 or later, where conversion to ZM\User objects causes invalid token state to fail before view dispatch. Additionally, ensure $user remains unset after failed token validation.
Other vulnerabilities in ZoneMinder
See all- CVE-2016-10206High
CVE-2016-10206 is a CSRF vulnerability in Zoneminder 1.30 and earlier that allows remote attackers to hijack user authentication for requests that change passwords and possibly other unspecified impacts.
- CVE-2016-10205High
Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie.
- CVE-2017-5368High
ZoneMinder versions 1.30 and 1.29 are vulnerable to CSRF attacks, allowing a remote attacker to make changes to the web application as the currently logged-in user. The attacker can silently create a new admin user, enabling further attacks.
- CVE-2016-10204Critical
CVE-2016-10204 is an SQL injection vulnerability in Zoneminder 1.30 and earlier that allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php.
- CVE-2026-102297Medium
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.
- CVE-2026-102296Medium
ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt parser state and crash the capture process or corrupt memory.
- CVE-2024-58386Medium
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials.
- CVE-2026-54258Medium
ZoneMinder versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI hides the restricted monitor, but direct event media views accept an arbitrary eid and stream media without enforcing event/monitor-level ACL.
- CVE-2026-76060High
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
- CVE-2026-72556High
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. canEdit() and canDelete() call nonexistent methods, causing PHP __call() to return truthy and bypass the check.
Original NVD description (English source)
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value to the global $user variable; because web/index.php tests isset($user), boolean false is treated as a present user and the normal login redirect is skipped. This can dispatch views that rely on the outer authentication gate, including the zones view, which accepts an attacker-selected monitor ID and discloses monitor and zone metadata without an independent permission check. Permission helpers receive the false user value and deny privileged operations, so unauthorized state changes have not been established. This vulnerability is fixed in version 1.36.63, where conversion to ZM\User objects causes invalid token state to fail before view dispatch. Later defense-in-depth changes explicitly leave $user unset after failed token validation and reject non-ZM\User values at the web authentication gate.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS