CVE-2026-102297Medium· 4.3▾ TwilightPoC availableZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied a…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Exploit / PoC code exists
Last analysed / modified upstream
0.2% → 0.3%
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102296Medium· 6.5ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers.…
CVE-2024-58386Medium· 6.5ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files
CVE-2026-30971High· 8.8ZoneMinder is a free, open source closed-circuit television software application
CVE-2026-102607High· 8.8ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
CVE-2026-104198Medium· 5.3ZoneMinder is a free, open source closed-circuit television software application
CVE-2026-54258Medium· 6.5ZoneMinder is a free, open source closed-circuit television software application