Incorrect authorization in ZoneMinder - #VU158956
Published: November 3, 2026
Vulnerability identifier: #VU158956
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to delete unarchived recordings belonging to monitors they are not authorized to access.
The vulnerability exists due to incorrect authorization in the Classic Events form deletion handler when processing supplied event IDs without checking access to the owning monitor. A remote user can submit a POST request to /?view=events with action=delete, a target event ID in eids[], and a valid CSRF token using an Events=Edit account to delete an unarchived recording from a restricted monitor.
Affected software
ZoneMinder
Remediation
Install security update from vendor's website.
ZoneMinder - update to 1.38.5