CVE-2026-102297
Medium
Description
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.
SeverityMedium
CVSS4.3
Exploit probability—
ProductZoneminder
PublishedSep 28, 2026
First seenSep 28, 2026
Weakness typeCWE-863Incorrect authorization
How to fix
Update
- ZoneMinder zoneminder1.38.4 or later
Patches
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ZoneMinder zoneminder | v < 1.38.4 | 1.38.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.