motionEye (mEye) is a video surveillance interface that, before version 0.44.0, sets the configuration file /etc/motioneye/motion.conf and per-camera configuration files (camera-*.conf) with 644 permissions, making them readable by any local user. These files contain sensitive information including the SHA1 admin password hash and camera credentials. The exposed admin password hash can be cracked offline to recover the plaintext password. This password can then be used to forge authenticated admin API requests due to a signature authentication weakness (GHSA-45h7-499j-7ww3) and combined with an OS command injection vulnerability (CVE-2025-60787) to escalate a local unprivileged user to the Motion daemon user, often root, leading to full system compromise. The vulnerability is resolved in motionEye version 0.44.0.

Local users on affected systems can read sensitive configuration files containing the admin password hash and camera credentials due to incorrect file permissions. The exposed SHA1 hash can be cracked offline, allowing attackers to recover the admin password. This can be leveraged to forge authenticated API requests and, when chained with other vulnerabilities, escalate privileges to root, resulting in full system compromise.

Upgrade motionEye to version 0.44.0 or later, where the issue is fixed by correcting file permissions on configuration files. No other mitigation is necessary as the fix addresses the root cause of the vulnerability.