CVE-2026-72556 in ZoneMinder
Summary
by MITRE • 08/11/2026
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class, causing PHP __call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-based OS command execution regardless of their assigned role.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical authorization bypass flaw in ZoneMinder version 1.39.17 that fundamentally undermines the application's security model. The issue stems from improper access control implementation within the Filter class where the canEdit() and canDelete() methods attempt to invoke non-existent methods on the ZM\User class. This design flaw triggers PHP's magic __call() method which returns a truthy value, effectively circumventing all permission checks and allowing any authenticated user to execute arbitrary operating system commands regardless of their assigned role or privileges. The vulnerability demonstrates a classic broken access control pattern that aligns with CWE-285, specifically addressing improper authorization within the application's permission validation mechanisms.
The technical exploitation occurs through a method resolution issue where PHP's dynamic method invocation fails gracefully rather than throwing an exception. When the Filter class attempts to call methods that don't exist on the ZM\User object, the __call() magic method intercepts this attempt and returns a positive boolean value instead of properly handling the missing method scenario. This behavior creates a security loophole where privilege validation becomes ineffective, allowing unauthorized command execution through filter operations that should be restricted to specific user roles. The vulnerability's impact extends beyond simple privilege escalation as it enables full system compromise through OS command injection.
From an operational standpoint, this vulnerability represents a severe risk to video surveillance systems that rely on ZoneMinder for security monitoring. Any authenticated user with access to the application can leverage this flaw to execute arbitrary commands on the underlying operating system, potentially leading to complete system compromise, data exfiltration, or denial of service conditions. The attack vector is particularly concerning because it requires only basic authentication credentials, making it accessible to anyone who can establish a valid session within the application. This vulnerability directly maps to ATT&CK technique T1059.001 for command and script injection, while also aligning with T1068 for local privilege escalation through improper access control.
Organizations should implement immediate mitigations including applying the vendor-provided patch or upgrade to a secure version of ZoneMinder that addresses this permission validation flaw. Network segmentation and monitoring of command execution patterns can help detect potential exploitation attempts, though the most effective solution remains proper code review and implementation of robust access control mechanisms. The vulnerability highlights the importance of defensive programming practices where method calls are properly validated and magic methods are carefully implemented to avoid unintended security implications. Additionally, implementing proper input sanitization for filter parameters and establishing comprehensive logging of administrative operations can help detect unauthorized access attempts while ensuring that all permission checks are properly enforced through explicit method validation rather than relying on fallback mechanisms that could introduce security weaknesses.