ZoneMinder cross-monitor event media authorization bypass (CVE-2025-54258)

ZoneMinder Cross-Monitor Event Media Authorization Bypass Vulnerability Summary Vulnerability Overview Vulnerability Name: Cross-monitor event media authorization bypass (Cross-monitor event media authorization bypass in direct event media endpoints) CVE ID: CVE-2025-54258 Severity: Moderate CVSS v3.1 Score: 6.5 / 10 Root Cause: The direct media endpoints only validate coarse-grained zone permissions (e.g., or ) and do not enforce per-event/per-monitor ACLs, allowing low-privilege users to access event media from monitors to which they have been denied access. Affected Scope Affected Versions: - - - Fixed Versions: - - - Affected Endpoints: - - - - (master branch only) Impact: Low-privilege authenticated users can retrieve event snapshots, capture frames, MP4 videos, and HLS playlists from monitors to which they are explicitly denied access, resulting in confidentiality leaks of surveillance footage (failure of object-level authorization). Remediation Upgrade to a fixed version (1.36.39 / 1.38.4 / 1.39.11). After the fix, the direct media endpoints no longer return media; instead, they return a or a redirect-capable , intercepting unauthorized requests before file path resolution, media streaming, video generation, or HLS playlist generation. Relevant code files: , , (master branch). POC / Exploit Code (Complete Extraction) 1. Hidden Event Snapshot Response (1.38.3): Response headers: 2. Hidden Event Capture Frame Response (1.38.3): 3. Hidden Event Video Response (1.38.3): Response headers: 4. Hidden Event HLS Playlist on Master Branch Response (master): The response body is a real playlist (not an error page): 5. Additional Comparisons (Accessible event 200 returns real media; Non-existent event 200 returns empty body; Permission removal results in 403/404) Actual Behavior vs. Expected Behavior Expected: Users denied access to monitor should not be able to retrieve event media belonging to . Actual: The standard UI hides monitor and event , yet the direct media endpoints still return the event's real JPEGs, MP4s, and HLS content, confirming that object-level authorization was bypassed.

Goal Reached Thanks to every supporter — we hit 100%!

ZoneMinder cross-monitor event media authorization bypass (CVE-2025-54258)

More from this source