CVE-2026-55863
Received Received - Intake

Unauthenticated Remote Action Execution in motionEye

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post() method in motioneye/handlers/action.py lacks the BaseHandler.auth() decorator, allowing an unauthenticated remote attacker to send requests to /action/<camera_id>/<action>. The endpoint can trigger snapshot, record_start, and record_stop actions. When an administrator has configured action scripts, the same endpoint can invoke PTZ controls, alarm actions, lighting actions, and other predefined commands, and configured remote motionEye cameras can allow server-side requests to the remote camera service. This issue is fixed in version 0.44.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55863
EUVD
EUVD-2026-78931

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
motioneye_project motioneye to 0.44.0 (exc)
motioneye_project motioneye From 0.44.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in motionEye (versions before 0.44.0) allows unauthenticated remote attackers to send requests to specific endpoints like /action/<camera_id>/<action>. The ActionHandler.post() method lacks proper authentication checks, enabling attackers to trigger actions such as taking snapshots, starting or stopping recordings, or invoking configured scripts for PTZ controls, alarms, or lighting. The flaw exists because the method does not include the @BaseHandler.auth() decorator, unlike other secured handlers.

Detection Guidance

Check motionEye version with: curl -s http://<motionEye_IP>:<port>/ | grep -i version. If version is below 0.44.0, the system is vulnerable. Inspect network traffic for unauthenticated POST requests to /action/<camera_id>/<action> endpoints using tools like tcpdump or Wireshark.

Impact Analysis

An attacker could exploit this to bypass physical security measures by remotely controlling cameras, capturing snapshots, or starting/stopping recordings without authorization. If action scripts are configured, attackers could trigger additional commands like PTZ movements, alarms, or lighting changes. In cases involving remote cameras, the vulnerability may also enable Server-Side Request Forgery (SSRF) attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to surveillance footage or camera controls, potentially violating data protection requirements under GDPR (e.g., unauthorized processing of personal data) or HIPAA (e.g., unauthorized access to sensitive video recordings). Non-compliance risks include legal penalties, reputational damage, and loss of trust due to inadequate security controls.

Mitigation Strategies

Upgrade motionEye to version 0.44.0 or later immediately. If upgrading is not possible, restrict access to motionEye web interface via firewall rules and disable action scripts until patched. Monitor logs for suspicious POST requests to /action endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55863. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart