Medium severity · published Sep 28, 2026
CVE-2026-102297
ZoneMinder before 1.38.4 Incorrect Authorization in frames API index
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZO
zoneminder · ZoneMinder
before 1.38.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102297
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102297
patch
https://github.com/ZoneMinder/zoneminder/commit/aafe580b231bbeead12a110a957d85a26f7a23be
product
https://github.com/ZoneMinder/zoneminder
vendor-advisory
https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mg2g-jmfc-3w8g
patch
https://github.com/ZoneMinder/zoneminder/commit/efe6c60d8798c60ab41b120dc034488388c47dda
release-notes
https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.4
technical-description
https://github.com/ZoneMinder/zoneminder/blob/1.38.3/web/api/app/Controller/FramesController.php#L51
More from zoneminder
9.9
CVE-2024-51482
Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64
9.8
CVE-2025-65791
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php
9.8
CVE-2024-43360
ZoneMinder Time-based SQL Injection
9.8
CVE-2023-26037
ZoneMinder contains SQL Injection via report_event_audit
9.8
CVE-2023-26036
ZoneMinder contains Local File Inclusion vulnerability