Description

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI correctly hides the restricted monitor and its events, but direct event media views accept an arbitrary `eid` and stream media from the event path without enforcing the event/monitor-level ACL. This exposes private surveillance footage across monitor boundaries. Versions 1.36.39, 1.38.4, and 1.39.11 fix the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-11T22:16:38.497Z",
  "pubdate": "2026-09-11T22:16:38.497Z",
  "executiveSummary": "ZoneMinder is vulnerable to an Insecure Direct Object Reference (IDOR) flaw, categorized as a Broken Access Control vulnerability.\nThe issue exists because the application fails to perform authorization checks when serving media for events requested via direct identifiers.\nWhile the web interface correctly filters and hides events based on a user's assigned monitor permissions, the backend media streaming endpoints do not validate if the authenticated user has authorization to access the specific requested event ID (eid).\nAn authenticated, low-privileged user possessing 'Events=View' or 'Snapshots=View' permissions can bypass intended security boundaries to access, stream, and download surveillance footage from monitors they are otherwise restricted from viewing.\nThis vulnerability compromises the confidentiality and privacy of sensitive surveillance data within the ZoneMinder deployment.\nExploitation requires active authentication as a low-privileged user and knowledge of event identifiers, which may be discoverable through enumeration or secondary channels.\nImpact includes unauthorized access to private, restricted surveillance footage, potentially leading to unauthorized data exfiltration or surveillance of restricted areas.",
  "technicalDetails": "The vulnerability resides in the backend request handling logic responsible for retrieving media files associated with recorded events. While ZoneMinder's frontend user interface implements a permission-based filter to prevent non-authorized users from viewing monitor-specific events, this client-side restriction is not mirrored by corresponding server-side enforcement on the media fetching endpoints.\nThe core issue is an Insecure Direct Object Reference (IDOR) where the application accepts a user-supplied 'eid' (Event ID) parameter to initiate a stream or fetch media from the filesystem or storage directory. The application fails to verify whether the requester, despite possessing 'Events=View' or 'Snapshots=View' permissions generally, holds the specific monitor-level authorization required to access the media associated with the provided 'eid'.\nAttackers can exploit this by crafting HTTP requests targeting the media retrieval endpoints, substituting a valid 'eid' that corresponds to a monitor they are not authorized to access. Because the backend logic lacks an ACL check between the authenticated session and the requested object, the server proceeds to stream the media content from the event path regardless of the user's restricted access level.\nThis flaw effectively bypasses the monitor-level partitioning designed into the software's access control architecture. An attacker with minimal privileges can enumerate or guess 'eid' values to systematically scrape or view sensitive footage across all monitors in the ZoneMinder instance, even those explicitly hidden from their UI dashboard.\nAffected versions include all iterations prior to 1.36.39, 1.38.4, and 1.39.11. The vulnerability is present in the server-side code responsible for mediating event media access. Successful exploitation necessitates an authenticated session, confirming that the vulnerability is specifically an authorization bypass rather than an unauthenticated disclosure. Post-exploitation, the threat actor can gain unauthorized access to private surveillance streams, resulting in severe privacy violations and potential regulatory non-compliance."
}