ZoneMinder versions before 1.38.4 have a vulnerability where per-monitor access restrictions are not enforced in the FramesController index endpoint. Authenticated users with Events view permission can access frame records from monitors they should not have access to, leading to unauthorized disclosure of event and frame metadata across monitor boundaries. The vulnerability has a medium severity with a CVSS score of 4.3.