UBUNTU-CVE-2026-102297

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-102297

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102297.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-102297

Upstream

CVE-2026-102297

Published

2026-09-28T22:17:00Z

Modified

2026-09-30T21:41:54Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.

References

Affected packages

Ubuntu:Pro:16.04:LTS / zoneminder

Package

Name: zoneminder
Purl: pkg:deb/ubuntu/zoneminder?arch=source&distro=esm-apps%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.28.1-8

1.29.0+dfsg-1

1.29.0+dfsg-1ubuntu1

1.29.0+dfsg-1ubuntu2

1.29.0+dfsg-1ubuntu2+esm1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "zoneminder",
            "binary_version":  "1.29.0+dfsg-1ubuntu2+esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102297.json"

Ubuntu:Pro:20.04:LTS / zoneminder

Package

Name: zoneminder
Purl: pkg:deb/ubuntu/zoneminder?arch=source&distro=esm-apps%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.32.3-2build1

1.32.3-2ubuntu1

1.32.3-2ubuntu2

1.32.3-2ubuntu2+esm1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "zoneminder",
            "binary_version":  "1.32.3-2ubuntu2+esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102297.json"

Ubuntu:Pro:22.04:LTS / zoneminder

Package

Name: zoneminder
Purl: pkg:deb/ubuntu/zoneminder?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.36.7+dfsg1-1

1.36.10+dfsg1-1

1.36.11+dfsg1-1

1.36.12+dfsg1-1

1.36.12+dfsg1-1ubuntu0.1~esm1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "zoneminder",
            "binary_version":  "1.36.12+dfsg1-1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102297.json"

Ubuntu:24.04:LTS / zoneminder

Package

Name: zoneminder
Purl: pkg:deb/ubuntu/zoneminder?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.36.33+dfsg1-1build1

1.36.33+dfsg1-1build2

1.36.33+dfsg1-1build3

1.36.33+dfsg1-1build4

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "zoneminder",
            "binary_version":  "1.36.33+dfsg1-1build4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102297.json"

Ubuntu:26.04:LTS / zoneminder

Package

Name: zoneminder
Purl: pkg:deb/ubuntu/zoneminder?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.36.35+dfsg1-1

1.36.37+dfsg1-1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "zoneminder",
            "binary_version":  "1.36.37+dfsg1-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102297.json"