CVE-2026-102297 in ZoneMinder
Summary
by MITRE • 09/29/2026
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in ZoneMinder versions prior to 1.38.4 represents a critical failure in role-based access control mechanisms within the application's web interface. Specifically, the FramesController index endpoint lacks proper authorization checks when handling requests for video frame data. This architectural flaw allows authenticated users who possess only Events view permissions to bypass intended security boundaries and retrieve metadata associated with monitors they are explicitly denied access to by system administrators. The core technical issue lies in the server-side logic that processes these API calls, which fails to validate whether the requesting user has sufficient privileges for the specific monitor ID included in the request parameters. Instead of enforcing strict isolation between different monitored areas or devices, the application relies on a broad permission check that grants access to all monitors associated with the Events view role, thereby ignoring granular per-monitor restrictions configured at the administrative level.
From an operational perspective, this vulnerability enables unauthorized information disclosure across monitor boundaries. An attacker who has obtained valid credentials for a low-privilege account can systematically enumerate and extract frame records from any camera or monitoring station connected to the ZoneMinder instance. The disclosed data includes event timestamps, file paths, and other metadata that may reveal sensitive operational details about the physical security infrastructure. This capability effectively neutralizes the purpose of implementing separate access levels for different users or departments, as it allows a single compromised account to aggregate surveillance data from restricted zones such as executive offices, server rooms, or secure entry points. The impact extends beyond simple privacy violations; in high-security environments, this could facilitate targeted attacks by revealing camera blind spots, operational schedules, or the presence of specific individuals based on event logs and frame metadata.
This flaw aligns with CWE-284 Improper Access Control, as it involves a failure to enforce proper authorization checks for sensitive resources. Furthermore, in the context of the MITRE ATT&CK framework, this vulnerability facilitates reconnaissance activities categorized under T1083 File and Directory Discovery or potentially T1561 Data from Information Repositories if the metadata is used to map out security infrastructure. The exploitation requires authenticated access, which places it within the scope of post-exploitation techniques where an attacker leverages existing credentials to escalate their informational reach without needing additional privilege escalation exploits.
Mitigation for this vulnerability involves upgrading ZoneMinder to version 1.38.4 or later, where the FramesController index endpoint has been patched to enforce strict per-monitor access validation before returning any frame data. Administrators should also review current user roles and permissions to ensure that the principle of least privilege is strictly applied across all monitoring stations. Additionally, implementing network-level segmentation for sensitive camera feeds can provide an additional layer of defense-in-depth, ensuring that even if application-layer controls are bypassed, direct access to critical surveillance infrastructure remains restricted through firewall rules or VLAN isolation. Regular auditing of user activity logs should be conducted to detect any anomalous patterns of frame retrieval that might indicate exploitation attempts against this vulnerability before patches are applied.