CVE-2026-102297

Received Received - Intake

ZoneMinder Frames API Access Bypass Exposes Monitor Data

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulnCheck

Description

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-29

EPSS Evaluated

N/A

NVD

CVE-2026-102297

Affected Vendors & Products

Vendor	Product	Version / Range
zoneminder	zoneminder	to 1.38.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

ZoneMinder before version 1.38.4 has a flaw in the FramesController index endpoint where it does not enforce per-monitor access restrictions properly. Authenticated users with permission to view events can access the frames API and retrieve frame records from monitors they are not authorized to access, which exposes event and frame metadata across different monitor boundaries.

Detection Guidance

To detect this vulnerability, check ZoneMinder logs for unauthorized access to the frames API by users with Events view permission. Monitor for requests to /zm/api/frames or similar endpoints from users who should not have access to certain monitors. Ensure per-monitor access restrictions are enforced in the FramesController index endpoint.

Impact Analysis

This vulnerability allows unauthorized users to view sensitive event and frame metadata from monitors they should not have access to. This could lead to information disclosure, privacy breaches, or unauthorized monitoring of restricted areas if the affected system is used for surveillance.

Compliance Impact

This vulnerability could violate compliance with privacy regulations such as GDPR or HIPAA by enabling unauthorized access to sensitive data. It may result in data breaches, unauthorized disclosure of personal or health information, and failure to maintain proper access controls as required by these standards.

Mitigation Strategies

Upgrade ZoneMinder to version 1.38.4 or later to address the access restriction bypass in the FramesController index endpoint.

Hi! I’m here to help you understand CVE-2026-102297. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70