CVE-2026-102297
ZoneMinder before 1.38.4 Incorrect Authorization in frames API index
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 28, 2026
- Updated
- Oct 6, 2026
- Reserved
- Sep 28, 2026
Description
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
zoneminderZoneMinder |
|
References
- Patch Commitpatch
- https://github.com/ZoneMinder/zoneminderproduct
- GitHub Security Advisory (GHSA-mg2g-jmfc-3w8g)vendor-advisory
- https://github.com/ZoneMinder/zoneminder/commit/efe6c60d8798c60ab41b120dc034488388c47ddapatch
- zoneminder 1.38.4 Release Notesrelease-notes
- https://github.com/ZoneMinder/zoneminder/blob/1.38.3/web/api/app/Controller/FramesController.php#L51technical-description
- VulnCheck Advisory: ZoneMinder before 1.38.4 Incorrect Authorization in frames API indexthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.