Zoneminder: Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions… (CVE-2026-54258)
Description
ZoneMinder versions prior to 1.36.39, 1.38.4, and 1.39.11 contain an authorization bypass vulnerability allowing authenticated low-privileged users with Events=View and/or Snapshots=View permissions to access private surveillance media from monitors they should not have access to. The user interface hides restricted monitors, but direct media requests using arbitrary event IDs bypass access controls, exposing private footage. The issue is fixed in versions 1.36.39, 1.38.4, and 1.39.11.
CVSS v3.1
Score 6.5medium
Affected software
pkg:deb/ubuntu/zoneminder?arch=source&distro=esm-apps/xenialpkg:deb/ubuntu/zoneminder?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/zoneminder?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/zoneminder?arch=source&distro=noblepkg:deb/ubuntu/zoneminder?arch=source&distro=stonkingpkg:deb/ubuntu/zoneminder?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ZoneMinder is an open source CCTV software. Versions before 1.36.39, 1.38.4, and 1.39.11 allow authenticated users with limited permissions (Events=View and/or Snapshots=View) to bypass event/monitor-level access controls by directly requesting media with arbitrary event IDs (eid). Although the UI hides unauthorized monitors and events, the backend media streaming endpoint does not enforce these ACLs, resulting in unauthorized access to private surveillance footage across monitor boundaries. This vulnerability is addressed in versions 1.36.39, 1.38.4, and 1.39.11.
Potential Impact
An authenticated low-privileged user can access private surveillance media from monitors they are not authorized to view, violating confidentiality. There is no impact on integrity or availability. This exposure of sensitive video footage can lead to privacy breaches.
Mitigation Recommendations
Upgrade ZoneMinder to version 1.36.39, 1.38.4, or 1.39.11 or later, where the issue is fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-54258
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6ad3f5fd2cdf04f656663fef
Added to database: 10/17/2026, 22:26:05 UTC
Last enriched: 10/18/2026, 00:50:00 UTC
Last updated: 10/18/2026, 00:50:00 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.