The vulnerability resides in the Media Gateway API’s authorization logic. An attacker who does not have playback rights can call the thumbnail generation endpoint and obtain a preview of video content. The resulting thumbnails expose video metadata and potentially reveal surveillance coverage, constituting a privacy violation and a privilege escalation scenario. This can be achieved without any elevated privileges beyond a standard user account.

The flaw affects Genetec Security Center. Specific versions are not listed in the advisory, but the security update referenced addresses the issue as of the Release 5.14.1.2.

The CVSS score of 6.5 indicates moderate impact. Exploit probability is not available and the vulnerability is not in the KEV catalog. The likely attack vector is via authenticated API requests from users that lack playback privileges. An attacker would simply submit a request to the thumbnail endpoint, which currently does not verify playback rights. Because the flaw is in the server‑side authorization, the risk is limited to users who have authenticated access to the API. No additional conditions such as elevated privileges or network isolation are required.