CVE-2026-54258 Overview
CVE-2026-54258 is an authorization flaw in ZoneMinder, an open-source closed-circuit television (CCTV) software application. Authenticated low-privileged users with coarse Events=View or Snapshots=View permissions can retrieve event media from monitors they are not authorized to access. The ZoneMinder web interface hides restricted monitors and their events, but direct event media endpoints accept an arbitrary event identifier (eid) without enforcing monitor-level access control lists (ACLs). This exposes private surveillance footage across tenant and monitor boundaries. The issue is classified as [CWE-639] Authorization Bypass Through User-Controlled Key. ZoneMinder versions 1.36.39, 1.38.4, and 1.39.11 remediate the flaw.
Critical Impact
Authenticated users can enumerate event IDs and stream surveillance footage from monitors outside their permission scope, breaking confidentiality of recorded video.
Affected Products
- ZoneMinder versions prior to 1.36.39 (1.36.x branch)
- ZoneMinder versions prior to 1.38.4 (1.38.x branch)
- ZoneMinder versions prior to 1.39.11 (1.39.x branch)
Discovery Timeline
- 2026-09-11 - CVE-2026-54258 published to the National Vulnerability Database (NVD)
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-54258
Vulnerability Analysis
ZoneMinder implements permission checks at the user interface layer to hide monitors and events a user is not authorized to view. The direct event media handler does not repeat this check server-side. When the handler receives an event identifier through the eid parameter, it locates the associated event path and streams media directly from disk. It never verifies whether the requesting user has access to the parent monitor.
Any authenticated account with the broad Events=View or Snapshots=View permission can therefore retrieve footage from every monitor in the deployment. Exploitation requires only valid credentials on the ZoneMinder instance and knowledge or guessing of numeric event identifiers, which are typically sequential.
Root Cause
The root cause is a missing object-level authorization check in the media streaming endpoint. ZoneMinder enforces ACLs when rendering event lists but treats the direct media fetch as trusted once the user is authenticated with a matching coarse permission. The event-to-monitor relationship is not evaluated before serving content, producing a classic Insecure Direct Object Reference (IDOR) pattern.
Attack Vector
Exploitation is performed over the network by any authenticated user with the required coarse permission. The attacker enumerates numeric eid values against the event media endpoint and receives video or snapshot data for events belonging to restricted monitors. No user interaction from a victim is required, and no privilege escalation on the underlying host is needed. Refer to the ZoneMinder GHSA-vj5r-pc2v-gfwv advisory for endpoint specifics.
Detection Methods for CVE-2026-54258
Indicators of Compromise
- Web server access logs showing a single authenticated session requesting event media with rapidly incrementing or non-sequential eid parameter values.
- Requests to event media or snapshot endpoints from user accounts whose ACL scope excludes the monitor associated with the returned event.
- Unusual volumes of media downloads originating from low-privileged accounts that historically only viewed a small subset of events.
Detection Strategies
- Correlate ZoneMinder application logs with the Events and Monitors database tables to flag media fetches where the requesting user lacks explicit access to the parent monitor.
- Deploy web application firewall (WAF) rules that baseline per-user access patterns to event media endpoints and alert on cross-monitor access.
- Audit ZoneMinder user permissions and identify accounts holding coarse Events=View or Snapshots=View grants that were not intended to be global.
Monitoring Recommendations
- Enable verbose access logging on the ZoneMinder web server and forward logs to a central analytics platform for retention and query.
- Alert on authenticated sessions that request more than a threshold number of distinct eid values within a short time window.
- Track failed and successful media requests per user and per monitor to establish behavioral baselines.
How to Mitigate CVE-2026-54258
Immediate Actions Required
- Upgrade ZoneMinder to version 1.36.39, 1.38.4, or 1.39.11 depending on the deployed release branch.
- Review all user accounts and revoke Events=View and Snapshots=View permissions from users who do not require access to all monitors.
- Rotate credentials for accounts suspected of having enumerated event identifiers during the exposure window.
Patch Information
The ZoneMinder maintainers released fixed versions 1.36.39, 1.38.4, and 1.39.11 that enforce monitor-level ACL checks in the direct event media handler. Details are documented in the ZoneMinder GHSA-vj5r-pc2v-gfwv advisory.
Workarounds
- Restrict network access to the ZoneMinder web interface to trusted administrative networks using a reverse proxy or firewall until patching is complete.
- Temporarily reduce the number of accounts holding the coarse Events=View and Snapshots=View permissions to the minimum operationally required.
- Place a reverse proxy in front of ZoneMinder that inspects the eid parameter and rejects requests from users whose session context does not include the associated monitor.
# Configuration example: verify installed ZoneMinder version and upgrade on Debian/Ubuntu
dpkg -l | grep -i zoneminder
sudo apt update
sudo apt install --only-upgrade zoneminder
systemctl restart zoneminder
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.