ZoneMinder CVE-2026-104198

Exploitation requires that ZoneMinder authentication is enabled (ZM_OPT_USE_AUTH on) and that token-based authentication is in use, on an affected version 1.34.0 through 1.36.38. The attacker must submit a token that fails validation (malformed or invalid signature) so that validateToken() returns boolean false, which index.php's isset($user) check then treats as a logged-in user, allowing dispatch of the zones view against an attacker-selected monitor ID. Limiting factors: impact is restricted to disclosure of monitor and zone metadata - privileged/state-changing operations remain blocked because permission helpers reject the false $user value; the web interface must be network-reachable by the attacker; and instances on 1.36.63 or later, or with authentication disabled in a way that changes this path, are not affected as described.

This is a genuine but limited-impact information-disclosure flaw, not a high-urgency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3 Medium) is internally consistent with the description: a remote, unauthenticated attacker can reach the vulnerable path over the network with low complexity and no user interaction, but impact is confined to low confidentiality (C:L) with no integrity or availability impact (I:N/A:N). The description itself constrains the risk - it explicitly states that permission helpers receive the false $user value and deny privileged operations, so unauthorized state changes have NOT been established; the realistic worst case is disclosure of monitor and zone metadata via the zones view. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation likelihood cannot be quantified from the data; the exploitation signal is therefore 'no public exploit identified at time of analysis.' No conflicting signals were observed - CVSS network vector and the description's web-interface mechanism agree. Overall: patch opportunistically on internet-exposed instances, but this does not rise to an emergency given metadata-only disclosure and absence of exploitation evidence.

An attacker who can reach a ZoneMinder web interface (versions 1.34.0-1.36.38) with authentication enabled submits a request carrying a malformed or invalid-signature authentication token. Because validateToken() returns boolean false and index.php only checks isset($user), the login redirect is skipped and the attacker reaches the zones view, supplying an arbitrary monitor ID to read monitor and zone metadata without a valid session. No public exploit code was identified in the provided data, though the logic flaw is trivially triggerable given the detailed advisory and commit diffs.