CVE-2026-102297Published
ZoneMinder before 1.38.4 Incorrect Authorization in frames API index
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-102297 · Microsoft / collected KEV context
cve-program · CVE-2026-102297
- https://github.com/ZoneMinder/zoneminder/commit/aafe580b231bbeead12a110a957d85a26f7a23be
- https://github.com/ZoneMinder/zoneminder
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mg2g-jmfc-3w8g
- https://github.com/ZoneMinder/zoneminder/commit/efe6c60d8798c60ab41b120dc034488388c47dda
- https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.4
- https://github.com/ZoneMinder/zoneminder/blob/1.38.3/web/api/app/Controller/FramesController.php#L51
- https://www.vulncheck.com/advisories/zoneminder-before-1.38.4-incorrect-authorization-in-frames-api-index
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.