Incorrect Authorization in ZoneMinder FramesController for Monitors
CVE-2026-102297

5.3MEDIUM

Key Information:

Vendor

Zoneminder

Status
Zoneminder
Vendor
CVE Published:
28 September 2026

What is CVE-2026-102297?

ZoneMinder versions prior to 1.38.4 are susceptible to incorrect authorization in the FramesController index endpoint. Authenticated users who have Events view permissions can exploit this vulnerability to retrieve frame records from monitors for which they are denied access. This could lead to unauthorized disclosure of event and frame metadata, compromising the security of sensitive monitor data across different user roles.

Affected Version(s)

zoneminder 0 < 1.38.4

zoneminder 1.38.4

References

https://github.com/ZoneMinder/zoneminder/commit/aafe580b2...
patch
https://github.com/ZoneMinder/zoneminder
product
https://github.com/ZoneMinder/zoneminder/security/advisor...
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

arpitjain099
leediay153
.