CVE-2026-32315: motionEye Information Disclosure Flaw

CVE-2026-32315 Overview

CVE-2026-32315 is an information disclosure vulnerability in motionEye (mEye), a web-based interface for the Motion video surveillance daemon. Versions prior to 0.44.0 create /etc/motioneye/motion.conf with 644 permissions, making the file world-readable on the local system. The configuration file stores the administrator SHA1 password hash and other sensitive settings. Per-camera configuration files (camera-*.conf) inherit the same permissive mode, exposing camera-specific credentials. Any unprivileged local user can read these files and extract material for offline cracking or authentication forgery. The issue is fixed in motionEye 0.44.0. [CWE-200] covers the underlying weakness class.

Critical Impact
Local users can read the admin password hash and chain this disclosure with related flaws to achieve full system compromise as the Motion daemon user (often root).

Affected Products

motionEye versions prior to 0.44.0
/etc/motioneye/motion.conf configuration file
Per-camera configuration files matching camera-*.conf

Discovery Timeline

2026-06-24 - CVE-2026-32315 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-32315

Vulnerability Analysis

motionEye writes its primary configuration file /etc/motioneye/motion.conf with file mode 644 (-rw-r--r--). Any local account on the host can read the file without elevated privileges. The configuration contains the administrator password hash computed with SHA1, along with operational parameters for the Motion daemon. Per-camera files written under the same directory follow the same mode, leaking camera URLs, stream credentials, and tuning parameters. The weakness is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

The disclosure becomes a privilege escalation primitive when combined with two related issues. The exposed SHA1 hash can be cracked offline using GPU-accelerated tools to recover the plaintext password. The hash can also be used directly to forge authenticated admin API requests through the signature authentication weakness tracked as GHSA-45h7-499j-7ww3. Chaining the recovered credentials with the OS command injection flaw in CVE-2025-60787 elevates a local unprivileged user to the Motion daemon account, which frequently runs as root.

Root Cause

The motionEye installation routine does not restrict file permissions on configuration artifacts containing secrets. The application relies on default umask behavior rather than explicitly applying restrictive modes such as 600 or 640 with a dedicated group. Storing the admin password as a SHA1 hash without salting compounds the disclosure by enabling fast offline cracking against precomputed tables.

Attack Vector

Exploitation requires local access with a low-privilege account. The attacker reads /etc/motioneye/motion.conf directly, extracts the @admin_password hash field, and either cracks it offline or replays it against the motionEye API signature scheme. Successful authentication grants administrative access to the web interface, after which the attacker can leverage chained vulnerabilities to execute commands as the Motion daemon user. No user interaction or network access is required.

Detection Methods for CVE-2026-32315

Indicators of Compromise

Unexpected reads of /etc/motioneye/motion.conf or camera-*.conf by non-root, non-motion accounts
Outbound API calls to the motionEye administrative endpoints from unusual source addresses or user-agents
New or modified administrator accounts in motionEye logs without corresponding legitimate activity
Spawning of shell processes as the Motion daemon user following authenticated API requests

Detection Strategies

Audit file permissions on /etc/motioneye/ and alert on any configuration file with world-readable mode
Enable Linux auditd rules on the motionEye configuration directory to log read access by uid != 0 and uid != motion
Correlate web access logs for the motionEye admin API with subsequent command execution events on the host

Monitoring Recommendations

Track changes to /etc/motioneye/motion.conf permissions and ownership over time
Monitor process lineage under the Motion daemon for unexpected child processes such as sh, bash, or network tools
Alert on local enumeration patterns that read configuration directories belonging to network services

How to Mitigate CVE-2026-32315

Immediate Actions Required

Upgrade motionEye to version 0.44.0 or later, which corrects the default file permissions
Manually restrict permissions on existing configuration files using chmod 600 /etc/motioneye/motion.conf and the matching camera-*.conf files
Rotate the motionEye administrator password after patching, assuming the previous hash may have been exposed
Review local account inventory on motionEye hosts and remove unnecessary shell users

Patch Information

The maintainers fixed the issue in motionEye 0.44.0. Refer to the GitHub MotionEye Release 0.44.0 notes and the GitHub Security Advisory GHSA-rhgp-6wq6-9j67 for details on the corrected installation routine.

Workarounds

Apply restrictive permissions manually with chown root:motion /etc/motioneye/*.conf and chmod 640 /etc/motioneye/*.conf until the upgrade is completed
Isolate motionEye hosts so that no untrusted local users have shell access
Disable or firewall the motionEye admin API from untrusted networks to reduce blast radius if credentials are recovered

bash

# Configuration example
sudo chown root:motion /etc/motioneye/motion.conf /etc/motioneye/camera-*.conf
sudo chmod 640 /etc/motioneye/motion.conf /etc/motioneye/camera-*.conf
sudo find /etc/motioneye -type f -name '*.conf' -perm /o+r -ls