Technical impact
ZoneMinder before version 1.38.4 contains a flaw in the FramesController index endpoint that does not enforce per‑monitor access restrictions. Authenticated users granted the Events view permission can query the frames API and retrieve frame records from monitors to which they are not authorized, which allows disclosure of event and frame metadata across monitor boundaries.
Affected Systems
All deployments of ZoneMinder older than 1.38.4 are affected. The vulnerability was present across the entire product line until the 1.38.4 release, which introduced the necessary authorization checks. Existing installations of any earlier release—whether on‑premises or hosted—must be evaluated for exposure.
Risk and Exploitability
The CVSS score of 5.3 reflects a moderate risk, with no exploit probability data available and the issue not listed in the CISA KEV catalog. Exploitation requires authentication and the Event view privilege; it does not lead to code execution or arbitrary command execution. However, the leak of metadata can facilitate further attacks or provide operational insight valuable to an adversary. The most likely attack vector is an authenticated user leveraging the public frames API, so restricting access to users with the Event view permission or disabling the API endpoint are practical mitigations until an official fix is deployed.
