CVE-2026-32315: CWE-732: Incorrect Permission Assignment for Critical Resource in motioneye-project motioneye
motionEye versions prior to 0.44.0 create configuration files with overly permissive 644 permissions, exposing sensitive data such as the admin password hash and camera credentials to any local user. This exposure allows offline cracking of the admin password hash, which can be exploited in combination with other vulnerabilities to escalate privileges and potentially compromise the entire system. The issue is fixed in version 0.44.0.
AI Analysis
Technical Summary
motionEye (mEye) is a video surveillance interface that, before version 0.44.0, sets the main configuration file (/etc/motioneye/motion.conf) and per-camera configuration files (camera-*.conf) with 644 permissions, making them readable by all local users. These files contain sensitive information including the SHA1 hashed admin password and camera credentials. The exposed admin password hash can be cracked offline to recover the plaintext password. This password can then be used to forge authenticated admin API requests due to a signature authentication weakness (GHSA-45h7-499j-7ww3). Furthermore, this can be chained with an OS command injection vulnerability (CVE-2025-60787) to escalate a local unprivileged user to the Motion daemon user, often root, enabling full system compromise. The vulnerability is addressed in motionEye version 0.44.0.
Potential Impact
Local users on affected systems can read sensitive configuration files containing the admin password hash and camera credentials. The exposed SHA1 hash can be cracked offline to obtain the plaintext admin password. Attackers can leverage this password to bypass authentication mechanisms and, combined with other vulnerabilities, escalate privileges to root, leading to full system compromise. The CVSS 3.1 base score is 5.5 (medium severity), reflecting the local attack vector and the potential confidentiality impact without direct integrity or availability impact.
Mitigation Recommendations
This vulnerability is fixed in motionEye version 0.44.0. Users should upgrade to version 0.44.0 or later to ensure configuration files have correct permissions and sensitive data is protected. No other mitigation is indicated by the vendor advisory. Patch status is confirmed by the version fix stated in the description.
CVE-2026-32315: CWE-732: Incorrect Permission Assignment for Critical Resource in motioneye-project motioneye
Description
motionEye versions prior to 0.44.0 create configuration files with overly permissive 644 permissions, exposing sensitive data such as the admin password hash and camera credentials to any local user. This exposure allows offline cracking of the admin password hash, which can be exploited in combination with other vulnerabilities to escalate privileges and potentially compromise the entire system. The issue is fixed in version 0.44.0.
CVSS v3.1
Score 5.5medium
Affected software
pkg:github/motioneye-project/motioneyeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
motionEye (mEye) is a video surveillance interface that, before version 0.44.0, sets the main configuration file (/etc/motioneye/motion.conf) and per-camera configuration files (camera-*.conf) with 644 permissions, making them readable by all local users. These files contain sensitive information including the SHA1 hashed admin password and camera credentials. The exposed admin password hash can be cracked offline to recover the plaintext password. This password can then be used to forge authenticated admin API requests due to a signature authentication weakness (GHSA-45h7-499j-7ww3). Furthermore, this can be chained with an OS command injection vulnerability (CVE-2025-60787) to escalate a local unprivileged user to the Motion daemon user, often root, enabling full system compromise. The vulnerability is addressed in motionEye version 0.44.0.
Potential Impact
Local users on affected systems can read sensitive configuration files containing the admin password hash and camera credentials. The exposed SHA1 hash can be cracked offline to obtain the plaintext admin password. Attackers can leverage this password to bypass authentication mechanisms and, combined with other vulnerabilities, escalate privileges to root, leading to full system compromise. The CVSS 3.1 base score is 5.5 (medium severity), reflecting the local attack vector and the potential confidentiality impact without direct integrity or availability impact.
Mitigation Recommendations
This vulnerability is fixed in motionEye version 0.44.0. Users should upgrade to version 0.44.0 or later to ensure configuration files have correct permissions and sensitive data is protected. No other mitigation is indicated by the vendor advisory. Patch status is confirmed by the version fix stated in the description.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-11T21:16:21.660Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3c4ce14853345fc1df8ce1
Added to database: 06/24/2026, 21:32:17 UTC
Last enriched: 06/24/2026, 21:47:11 UTC
Last updated: 06/25/2026, 03:23:15 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.