CVE-2026-102297: ZoneMinder before 1.38.4 Incorrect Authorization in frames API index
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZoneMinderto a version that resolves this vulnerability.Fixed in 1.38.4
Event History
Frequently Asked Questions
Which users could exploit this issue?
An attacker needs an authenticated ZoneMinder account with Events view permission. The issue is relevant where that user is intentionally denied access to one or more monitors.
What information can be exposed?
The frames API can return event and frame metadata for monitors outside the requesting user's permitted monitor scope. The provided information does not indicate disclosure of frame image contents.
How can the issue be remediated?
Upgrade ZoneMinder to version 1.38.4 or later. Versions before 1.38.4 are affected.