Incorrect authorization in ZoneMinder - CVE-2026-102297
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote user to disclose frame metadata for monitors they are not authorized to access.
The vulnerability exists due to incorrect authorization in ZoneMinder's FramesController::index() when handling frame-listing requests: the computed per-monitor restriction is not applied to the database query. A remote user can use an account with Events permission set to View to request /zm/api/frames.json or target a denied monitor through /zm/api/frames/index.json/MonitorId:5 to retrieve its frame records, including event and monitor identifiers, timestamps, motion scores, and frame types.
The disclosure does not include JPEG images; access to the actual media remains subject to authorization checks on the owning event.