CVE-2026-54258 Cross-monitor event media authorization bypass in direct event media endpoints
Authenticated low-privileged users can bypass monitor access controls to view private surveillance footage from restricted monitors via direct media endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54258?
CVE-2026-54258 is a medium-severity missing authorization vulnerability in zoneminder, published on 11 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI correctly hides the restricted monitor and its events, but direct event media views accept an arbitrary `eid` and stream media from the event path without enforcing the event/monitor-level ACL. This exposes private surveillance footage across monitor boundaries. Versions 1.36.39, 1.38.4, and 1.39.11 fix the issue.
Weakness: CWE-639
Which versions are affected by CVE-2026-54258?
How do I fix CVE-2026-54258?
No fix has been published for CVE-2026-54258 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-54258 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54258 exists.
Sources
Also known as DEBIAN-CVE-2026-54258, GHSA-vj5r-pc2v-gfwv, UBUNTU-CVE-2026-54258.