Zoneminder has a vulnerability!

[biologisch]

With activated authentication there is a vulnerability that allows to inspect cam records of other users.

Example: User1 is associated to Monitor2 and User2 to Monitor2.
You can see after logging in as User1 the own camera and all stored images.
(http://localhost/zm/index.php?view=watch&mid=1)

Now change as logged in User1 the browser url mid=1 to mid=2
(http://localhost/zm/index.php?view=watch&mid=2)

User1 can now see all stored pictures of User2. (not live cam)

How to fix?

Greetings,
biologisch

[biologisch]

Here a screenshot from the vulnerability:

[iconnor]

Thanks for the report!

We have fixed this in our master dev branch. We will be releasing 1.28.1 soon with this fix.

[biologisch]

Thanks for the first answer after more than 6 month!