CVE-2026-55863

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55863
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55863.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55863
Aliases
Published
2026-09-15T16:46:41Z
Modified
2026-09-16T03:47:02Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution
Details

motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post() method in motioneye/handlers/action.py lacks the BaseHandler.auth() decorator, allowing an unauthenticated remote attacker to send requests to /action/<camera_id>/. The endpoint can trigger snapshot, record_start, and record_stop actions. When an administrator has configured action scripts, the same endpoint can invoke PTZ controls, alarm actions, lighting actions, and other predefined commands, and configured remote motionEye cameras can allow server-side requests to the remote camera service. This issue is fixed in version 0.44.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55863.json"
}
References

Affected packages

Git / github.com/motioneye-project/motioneye

Affected ranges

Type
GIT
Repo
https://github.com/motioneye-project/motioneye
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
505e250f09921056d2f355e33cbabb9bc2d2117f
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.44.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.1
0.10
0.11
0.12
0.13
0.14
0.15
0.16
0.17
0.18
0.19
0.2
0.20
0.21
0.22
0.23
0.24
0.25
0.25.1
0.25.2
0.26
0.27
0.27.1
0.27.2
0.28
0.28.1
0.28.2
0.28.3
0.29rc1
0.29rc2
0.3
0.30
0.30rc1
0.30rc2
0.31
0.31.1
0.31.2
0.31.3
0.31.4
0.34
0.34.1
0.34rc1
0.35
0.35.1
0.35.2
0.35rc1
0.36
0.36.1
0.37
0.37rc1
0.38
0.39
0.39.1
0.39.3
0.4
0.40
0.40rc1
0.40rc2
0.40rc3
0.40rc4
0.40rc5
0.41
0.41rc1
0.42
0.42.1
0.43.1
0.43.1b1
0.43.1b2
0.5
0.6
0.7
0.8
0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55863.json"