CVE-2026-102297

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102297
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102297.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102297
Aliases
  • GHSA-mg2g-jmfc-3w8g
Downstream
Published
2026-09-28T22:00:19Z
Modified
2026-10-01T03:30:41Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
ZoneMinder before 1.38.4 Incorrect Authorization in frames API index
Details

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102297.json"
}
References

Affected packages

Git / github.com/zoneminder/zoneminder

Affected ranges

Type
GIT
Repo
https://github.com/zoneminder/zoneminder
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b2192aa427fcdeec797d1b4d0605e6d7f2661b12
Fixed
aafe580b231bbeead12a110a957d85a26f7a23be
Fixed
efe6c60d8798c60ab41b120dc034488388c47dda
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.38.4"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.32.3
1.34.0
1.36.0
1.38.0
1.38.1
1.38.2
1.38.3
v1.*
v1.25
v1.26.0
v1.26.1
v1.26.2
v1.26.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102297.json"