CVE-2026-65422: Genetec Security Center Auth Bypass Flaw

CVE-2026-65422 Overview

CVE-2026-65422 is a missing authorization flaw [CWE-862] in the Media Gateway API of Genetec Security Center. The weakness lets an authenticated user without playback privileges generate video thumbnails through the API. Because the authorization check is incomplete, the server returns image data derived from recorded video streams the user should not access. This exposes surveillance footage to users whose roles were explicitly configured to deny playback.

Critical Impact

Authenticated users without playback permissions can retrieve video thumbnails from recorded streams, breaking confidentiality of surveillance footage managed by Genetec Security Center.

Affected Products

• Genetec Security Center 5.14 (versions prior to 5.14.1.2)
• Media Gateway API component
• Deployments using role-based playback restrictions

Discovery Timeline

• 2026-09-24 - CVE CVE-2026-65422 published to the National Vulnerability Database (NVD)
• 2026-09-24 - Last updated in NVD database
• Security Center 5.14.1.2 - Genetec publishes resolved vulnerability advisory

Technical Details for CVE-2026-65422

Vulnerability Analysis

The Media Gateway service in Genetec Security Center exposes an API that renders video thumbnails from recorded streams. The thumbnail endpoint relies on an authorization decision that does not fully evaluate the user's playback privileges before returning rendered frames. An authenticated user without the View playback video right can therefore invoke the thumbnail generator and receive still images from cameras they are not entitled to view.

The flaw is categorized as Missing Authorization [CWE-862]. Authentication is enforced, but the server-side permission check that gates playback-derived content is absent or incorrectly applied for the thumbnail path. The attack is executed over the network with low privileges and no user interaction, affecting confidentiality while leaving integrity and availability intact.

Root Cause

The authorization logic for the Media Gateway thumbnail endpoint does not share the same privilege verification used by the full playback stream path. The endpoint validates session identity but omits the role-based entitlement check for recorded video access. This divergence between playback and thumbnail code paths allows a user to bypass the intended least-privilege policy.

Attack Vector

An attacker needs valid credentials to the Security Center environment with any role that lacks playback rights, such as a monitoring or administrative role scoped away from cameras. The attacker sends crafted HTTP requests to the Media Gateway thumbnail API, specifying camera identifiers and timestamps. The server returns thumbnail images sourced from the restricted recordings. No exploit code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Genetec Security Update 5.14 advisory for vendor-provided technical details.

Detection Methods for CVE-2026-65422

Indicators of Compromise

• Media Gateway access logs showing thumbnail API requests from user accounts whose role lacks the View playback video privilege.
• Unexpected volumes of thumbnail requests spanning multiple camera identifiers from a single session.
• Requests to thumbnail endpoints targeting camera archives outside the requester's assigned area or partition.

Detection Strategies

• Correlate Security Center audit trails with role assignments to flag thumbnail requests that should have been denied by playback policy.
• Baseline normal thumbnail usage per role and alert on deviations, especially from non-operator accounts.
• Enable verbose logging on the Media Gateway and forward events to a central log platform for query-based review.

Monitoring Recommendations

• Ingest Genetec Security Center and Media Gateway logs into a SIEM or data lake for cross-referencing with identity data.
• Monitor for API enumeration patterns against the thumbnail endpoint, including sequential camera ID access.
• Review account activity for roles explicitly denied playback to confirm no recorded video artifacts were retrieved.

How to Mitigate CVE-2026-65422

Immediate Actions Required

• Upgrade Genetec Security Center to version 5.14.1.2 or later, which resolves the Media Gateway authorization flaw.
• Audit all user roles that interact with the Media Gateway and remove unnecessary accounts with API access.
• Rotate credentials for accounts suspected of abusing the thumbnail endpoint before patching.

Patch Information

Genetec addressed the issue in Security Center 5.14.1.2. Administrators should review the Resolved vulnerabilities in Security Center 5.14.1.2 advisory and apply the update across all Security Center servers that host the Media Gateway role.

Workarounds

• Restrict network access to the Media Gateway API to trusted operator workstations until patching is complete.
• Place the Media Gateway behind a reverse proxy that enforces additional access control on thumbnail endpoints.
• Temporarily disable API-facing integrations that are not required for operational monitoring.

# Example: restrict Media Gateway API exposure with host-based firewall rules
# Replace 10.0.0.0/24 with the trusted operator subnet
New-NetFirewallRule -DisplayName "Genetec MediaGateway API Allow" \
  -Direction Inbound -Protocol TCP -LocalPort 654 \
  -RemoteAddress 10.0.0.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Genetec MediaGateway API Block" \
  -Direction Inbound -Protocol TCP -LocalPort 654 \
  -Action Block