Incorrect authorization in ZoneMinder - #VU158957
Published: November 3, 2026
Vulnerability identifier: #VU158957
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to archive recordings belonging to monitors they are not authorized to access.
The vulnerability exists due to incorrect authorization in the Classic Events bulk AJAX archive handler when updating archive status by supplied event ID without checking access to the owning monitor. A remote user can send a request with request=events, task=archive, and a target event ID in eids[] using an Events=View account to change the archive state of a recording from a restricted monitor.
Affected software
ZoneMinder
Remediation
Install security update from vendor's website.
ZoneMinder - update to 1.38.5