CVE-2026-102297CWE-863broken-access-control

CVE-2026-102297

Medium · published September 29, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
12.1
In the wild
Unconfirmed
What it is

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00222 · 12.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-29T02:17Z
References (8)
https://github.com/ZoneMinder/zoneminder · [email protected]https://github.com/ZoneMinder/zoneminder/blob/1.38.3/web/api/app/Controller/FramesController.php#L51 · [email protected]https://github.com/ZoneMinder/zoneminder/commit/aafe580b231bbeead12a110a957d85a26f7a23be · [email protected]https://github.com/ZoneMinder/zoneminder/commit/efe6c60d8798c60ab41b120dc034488388c47dda · [email protected]https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.4 · [email protected]https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mg2g-jmfc-3w8g · [email protected]https://www.vulncheck.com/advisories/zoneminder-before-1.38.4-incorrect-authorization-in-frames-api-index · [email protected]https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mg2g-jmfc-3w8g · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 28 SEP 22:00Z
    ZoneMinder before 1.38.4 Incorrect Authorization in frames API index
    cvelistv5