CVE-2026-54258
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
ZoneMinder versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI hides the restricted monitor, but direct event media views accept an arbitrary eid and stream media without enforcing event/monitor-level ACL.
Risk Assessment
This exposes private surveillance footage across monitor boundaries, violating access control. It may lead to leakage of sensitive video data.
Recommendation
Update ZoneMinder to version 1.36.39, 1.38.4, or 1.39.11, which fix the issue.
Other vulnerabilities in ZoneMinder
See all- CVE-2016-10206High
CVE-2016-10206 is a CSRF vulnerability in Zoneminder 1.30 and earlier that allows remote attackers to hijack user authentication for requests that change passwords and possibly other unspecified impacts.
- CVE-2016-10205High
Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie.
- CVE-2017-5368High
ZoneMinder versions 1.30 and 1.29 are vulnerable to CSRF attacks, allowing a remote attacker to make changes to the web application as the currently logged-in user. The attacker can silently create a new admin user, enabling further attacks.
- CVE-2016-10204Critical
CVE-2016-10204 is an SQL injection vulnerability in Zoneminder 1.30 and earlier that allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php.
- CVE-2026-76060High
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
- CVE-2026-72556High
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. canEdit() and canDelete() call nonexistent methods, causing PHP __call() to return truthy and bypass the check.
- CVE-2023-31493Medium
A Remote Code Execution (RCE) vulnerability in ZoneMinder through version 1.36.33 allows an attacker to create a new .php log file in the language folder. By executing a crafted payload, the attacker can escalate privileges and execute arbitrary commands on the remote system.
Original NVD description (English source)
ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI correctly hides the restricted monitor and its events, but direct event media views accept an arbitrary `eid` and stream media from the event path without enforcing the event/monitor-level ACL. This exposes private surveillance footage across monitor boundaries. Versions 1.36.39, 1.38.4, and 1.39.11 fix the issue.