What’s Vulnerable › Vulnerabilities

CVE-2026-102297: ZoneMinder before 1.38.4 Incorrect Authorization in frames API index

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-28 · updated 2026-09-30
• Weakness: CWE-863

Description

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.

Affected products

• zoneminder: before 1.38.4 — fixed in 1.38.4

How to fix

Upgrade to a fixed version: zoneminder 1.38.4. Check the vendor advisory for mitigations.

References

• https://github.com/ZoneMinder/zoneminder
• https://github.com/ZoneMinder/zoneminder/blob/1.38.3/web/api/app/Controller/FramesController.php#L51
• https://github.com/ZoneMinder/zoneminder/commit/aafe580b231bbeead12a110a957d85a26f7a23be
• https://github.com/ZoneMinder/zoneminder/commit/efe6c60d8798c60ab41b120dc034488388c47dda
• https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.4
• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mg2g-jmfc-3w8g
• https://www.vulncheck.com/advisories/zoneminder-before-1.38.4-incorrect-authorization-in-frames-api-index
• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mg2g-jmfc-3w8g

Get alerted when CVE-2026-102297 or the next vulnerability affects your stack