Executive brief
motionEye is a web-based interface for managing video surveillance and motion detection cameras. In affected versions, the software saves sensitive configuration files with insecure permissions that allow any user on the same computer to read them. This could allow a low-privileged user to steal administrator password hashes and camera credentials, potentially leading to full control over the surveillance system or the underlying server.
Technical details
motionEye versions prior to 0.44.0 create the main configuration file (/etc/motioneye/motion.conf) and per-camera files (camera-*.conf) with 644 (-rw-r--r--) permissions. This root cause allows any local unprivileged user to read the '@admin_password' field, which contains a SHA1 hash of the administrator password. An attacker can crack this hash offline or use it to forge API requests by exploiting a separate signature authentication weakness. When chained with other vulnerabilities like CVE-2025-60787, this can lead to local privilege escalation to the Motion daemon user (often root). The issue is resolved in version 0.44.0 by enforcing 0600 permissions on these files.
Affected products
- motioneye-project motionEye < 0.44.0
Timeline
- 2026-03-11: disclosed: Vulnerability discovered and vendor notified
- 2026-03-12: other: Vendor acknowledged and confirmed fix in beta
- 2026-06-20: patched: Version 0.44.0 released
- 2026-06-24: advisory: NVD and GitHub advisories published