Description
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ZoneMinder | zoneminder | < 1.38.4 | 1.38.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zoneminder | No fix yet | — |
| Debian 13 | zoneminder | No fix yet | — |
| Debian 12 | zoneminder | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | zoneminder | No fix yet | — |
| Ubuntu 26.04 LTS | zoneminder | No fix yet | — |
| Ubuntu 24.04 LTS | zoneminder | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | zoneminder | No fix yet | — |
| Ubuntu Pro 20.04 LTS | zoneminder | No fix yet | — |
| Ubuntu Pro 16.04 LTS | zoneminder | No fix yet | — |
References
- Patch Commit patch
- https://github.com/ZoneMinder/zoneminder product
- GitHub Security Advisory (GHSA-mg2g-jmfc-3w8g) vendor-advisory
- https://github.com/ZoneMinder/zoneminder/commit/efe6c60d8798c60ab41b120dc034488388c47dda patch
- zoneminder 1.38.4 Release Notes release-notes
- https://github.com/ZoneMinder/zoneminder/blob/1.38.3/web/api/app/Controller/FramesController.php#L51 technical-description
- VulnCheck Advisory: ZoneMinder before 1.38.4 Incorrect Authorization in frames API index third-party-advisory