ID:12759 - Exploit for Authorization bypass through user-controlled key in ZoneMinder - CVE-2026-54258

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the cross-monitor event media authorization bypass in direct event media endpoints. A remote user can retrieve private event media on the system.

Remediation