What is CVE-2026-54258?

CVE-2026-54258 is a medium-severity vulnerability in Zoneminder, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-09-11.

How severe is CVE-2026-54258?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Zoneminder

CVE-2026-54258

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI correctly hides the restricted monitor and its events, but direct event media views accept an arbitrary `eid` and stream media from the event path without enforcing the event/monitor-level ACL. This exposes private surveillance footage across monitor boundaries. Versions 1.36.39, 1.38.4, and 1.39.11 fix the issue.

Vulnerability class: IDOR (Insecure Direct Object Reference)

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Zoneminder — versions < 1.36.39, >= 1.37.0, < 1.38.4, >= 1.39.0, < 1.39.11

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-54258?: CVE-2026-54258 is a medium-severity vulnerability in Zoneminder, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-09-11.
How severe is CVE-2026-54258?: Medium severity. CVSS v3 base score is 6.5 out of 10.