Executive brief
ZoneMinder is open-source video surveillance software used to manage security cameras and store recorded footage. A flaw allows authenticated users with basic viewing permissions to access surveillance video from cameras they have explicitly been denied access to, by directly requesting the video using a camera's internal event ID. This bypasses the intended access controls and exposes private security footage across camera boundaries.
Technical details
This is a Broken Object Level Authorization (BOLA) vulnerability in ZoneMinder's direct media endpoints. The vulnerable endpoints (GET /zm/index.php?view=image, GET /zm/index.php?view=view_video, GET /zm/index.php?view=view_hls) check only coarse permission checks like canView('Events') or canView('Snapshots') but fail to enforce per-monitor and per-event access control lists (ACLs) via the $Event->canView() method. An authenticated low-privileged user with broad Events=View or Snapshots=View permissions can bypass monitor-level restrictions by directly supplying an arbitrary event ID (eid parameter) to these endpoints, directly accessing media from restricted monitors. The normal web UI correctly hides restricted monitors and events, but these direct media handlers circumvent that authorization layer. Attack requires valid authentication but no further user interaction. Patches are available in versions 1.36.39, 1.38.4, and 1.39.11.
Affected products
- ZoneMinder ZoneMinder before 1.36.39, 1.37.0 before 1.38.4, 1.39.0 before 1.39.11
Timeline
- 2026-06-03: disclosed: GitHub Security Advisory published
- 2026-06-03: patched: Versions 1.36.39, 1.38.4, and 1.39.11 released