A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission… (CVE-2026-72556)

A remote code execution vulnerability exists in ZoneMinder 1.39.17 due to a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class, triggering PHP's __call() magic method to return a truthy value. This behavior bypasses permission checks for all authenticated users regardless of their assigned roles, allowing them to execute OS commands via filter-based functionality.

Any authenticated user can exploit this vulnerability to execute arbitrary operating system commands on the affected ZoneMinder server. This leads to full compromise of confidentiality, integrity, and availability of the system. The vulnerability is rated with a CVSS 3.1 score of 8.8 (high severity). No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to trusted personnel only and monitor for suspicious activity related to filter usage. Avoid granting unnecessary permissions to users. Follow vendor updates closely for official patches or workarounds.