Vulnerability-Lookup

CVE-2026-55863 (GCVE-0-2026-55863)

Vulnerability from cvelistv5 – Published: 2026-09-15 16:46 – Updated: 2026-09-16 14:56

Title

motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution

Summary

motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post() method in motioneye/handlers/action.py lacks the BaseHandler.auth() decorator, allowing an unauthenticated remote attacker to send requests to /action/<camera_id>/<action>. The endpoint can trigger snapshot, record_start, and record_stop actions. When an administrator has configured action scripts, the same endpoint can invoke PTZ controls, alarm actions, lighting actions, and other predefined commands, and configured remote motionEye cameras can allow server-side requests to the remote camera service. This issue is fixed in version 0.44.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 14:56 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/motioneye-project/motioneye/se…	x_refsource_CONFIRM
https://github.com/motioneye-project/motioneye/pu…	x_refsource_MISC
https://github.com/motioneye-project/motioneye/co…	x_refsource_MISC
https://github.com/motioneye-project/motioneye/re…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
motioneye-project	motioneye	Affected: < 0.44.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55863",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T14:56:48.062550Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T14:56:56.632Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "motioneye",
          "vendor": "motioneye-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.44.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "motionEye (mEye) is an online interface for a piece of software called \"motion,\" which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post() method in motioneye/handlers/action.py lacks the BaseHandler.auth() decorator, allowing an unauthenticated remote attacker to send requests to /action/\u003ccamera_id\u003e/\u003caction\u003e. The endpoint can trigger snapshot, record_start, and record_stop actions. When an administrator has configured action scripts, the same endpoint can invoke PTZ controls, alarm actions, lighting actions, and other predefined commands, and configured remote motionEye cameras can allow server-side requests to the remote camera service. This issue is fixed in version 0.44.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T16:46:41.756Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv"
        },
        {
          "name": "https://github.com/motioneye-project/motioneye/pull/3332",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/motioneye-project/motioneye/pull/3332"
        },
        {
          "name": "https://github.com/motioneye-project/motioneye/commit/0d5cb9c238a87447dae29812e5bf2ccf323cf3dc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/motioneye-project/motioneye/commit/0d5cb9c238a87447dae29812e5bf2ccf323cf3dc"
        },
        {
          "name": "https://github.com/motioneye-project/motioneye/releases/tag/0.44.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/motioneye-project/motioneye/releases/tag/0.44.0"
        }
      ],
      "source": {
        "advisory": "GHSA-j67x-q29f-qcvv",
        "discovery": "UNKNOWN"
      },
      "title": "motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55863",
    "datePublished": "2026-09-15T16:46:41.756Z",
    "dateReserved": "2026-06-17T16:44:40.996Z",
    "dateUpdated": "2026-09-16T14:56:56.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55863",
      "date": "2026-09-21",
      "epss": "0.00289",
      "percentile": "0.21701"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "motioneye",
                "vendor": "motioneye-project",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.44.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "motionEye (mEye) is an online interface for a piece of software called \"motion,\" which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post() method in motioneye/handlers/action.py lacks the BaseHandler.auth() decorator, allowing an unauthenticated remote attacker to send requests to /action/\u003ccamera_id\u003e/\u003caction\u003e. The endpoint can trigger snapshot, record_start, and record_stop actions. When an administrator has configured action scripts, the same endpoint can invoke PTZ controls, alarm actions, lighting actions, and other predefined commands, and configured remote motionEye cameras can allow server-side requests to the remote camera service. This issue is fixed in version 0.44.0."
          }
        ],
        "id": "CVE-2026-55863",
        "lastModified": "2026-09-16T15:17:37.907",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-55863",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T14:56:48.062550Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-15T17:17:22.967",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/motioneye-project/motioneye/commit/0d5cb9c238a87447dae29812e5bf2ccf323cf3dc"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/motioneye-project/motioneye/pull/3332"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/motioneye-project/motioneye/releases/tag/0.44.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55863",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-16T14:56:48.062550Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-16T14:56:29.863Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "motioneye",
              "vendor": "motioneye-project",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.44.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "motionEye (mEye) is an online interface for a piece of software called \"motion,\" which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post() method in motioneye/handlers/action.py lacks the BaseHandler.auth() decorator, allowing an unauthenticated remote attacker to send requests to /action/\u003ccamera_id\u003e/\u003caction\u003e. The endpoint can trigger snapshot, record_start, and record_stop actions. When an administrator has configured action scripts, the same endpoint can invoke PTZ controls, alarm actions, lighting actions, and other predefined commands, and configured remote motionEye cameras can allow server-side requests to the remote camera service. This issue is fixed in version 0.44.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-15T16:46:41.756Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv"
            },
            {
              "name": "https://github.com/motioneye-project/motioneye/pull/3332",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/motioneye-project/motioneye/pull/3332"
            },
            {
              "name": "https://github.com/motioneye-project/motioneye/commit/0d5cb9c238a87447dae29812e5bf2ccf323cf3dc",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/motioneye-project/motioneye/commit/0d5cb9c238a87447dae29812e5bf2ccf323cf3dc"
            },
            {
              "name": "https://github.com/motioneye-project/motioneye/releases/tag/0.44.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/motioneye-project/motioneye/releases/tag/0.44.0"
            }
          ],
          "source": {
            "advisory": "GHSA-j67x-q29f-qcvv",
            "discovery": "UNKNOWN"
          },
          "title": "motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-55863",
        "datePublished": "2026-09-15T16:46:41.756Z",
        "dateReserved": "2026-06-17T16:44:40.996Z",
        "dateUpdated": "2026-09-16T14:56:56.632Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55863

Vulnerability from fkie_nvd - Published: 2026-09-15 17:17 - Updated: 2026-09-16 15:17

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/motioneye-project/motioneye/commit/0d5cb9c238a87447dae29812e5bf2ccf323cf3dc
	security-advisories@github.com	https://github.com/motioneye-project/motioneye/pull/3332
	security-advisories@github.com	https://github.com/motioneye-project/motioneye/releases/tag/0.44.0
	security-advisories@github.com	https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "motioneye",
          "vendor": "motioneye-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.44.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "motionEye (mEye) is an online interface for a piece of software called \"motion,\" which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post() method in motioneye/handlers/action.py lacks the BaseHandler.auth() decorator, allowing an unauthenticated remote attacker to send requests to /action/\u003ccamera_id\u003e/\u003caction\u003e. The endpoint can trigger snapshot, record_start, and record_stop actions. When an administrator has configured action scripts, the same endpoint can invoke PTZ controls, alarm actions, lighting actions, and other predefined commands, and configured remote motionEye cameras can allow server-side requests to the remote camera service. This issue is fixed in version 0.44.0."
    }
  ],
  "id": "CVE-2026-55863",
  "lastModified": "2026-09-16T15:17:37.907",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55863",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-16T14:56:48.062550Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T17:17:22.967",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/motioneye-project/motioneye/commit/0d5cb9c238a87447dae29812e5bf2ccf323cf3dc"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/motioneye-project/motioneye/pull/3332"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/motioneye-project/motioneye/releases/tag/0.44.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-J67X-Q29F-QCVV

Vulnerability from github – Published: 2026-06-23 18:37 – Updated: 2026-06-23 18:37

Summary

motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution

Details

Summary

The ActionHandler.post() method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions including snapshots, recording start/stop, and configured action scripts (PTZ controls, alarm triggers, etc.).

Vulnerability Details

File: motioneye/handlers/action.py — ActionHandler.post() line 36 CWE: CWE-862 — Missing Authorization CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3 Medium

Vulnerable Code

class ActionHandler(BaseHandler):
    async def post(self, camera_id, action):   # ← NO @BaseHandler.auth() decorator
        camera_id = int(camera_id)
        if camera_id not in config.get_camera_ids():
            raise HTTPError(404, 'no such camera')
        ...
        if action == 'snapshot':
            await self.snapshot(camera_id)   # executed without auth
            return
        elif action == 'record_start':
            return self.record_start(camera_id)
        elif action == 'record_stop':
            return self.record_stop(camera_id)

        action_commands = config.get_action_commands(local_config)
        command = action_commands.get(action)
        ...
        self.run_command_bg(command)   # executes predefined shell scripts

Compare with other handlers that correctly require authentication:

@BaseHandler.auth(admin=True)   # ← properly protected
async def delete(self, camera_id, filename):
    ...

Steps to Reproduce

Deploy motionEye with at least one camera configured
Send unauthenticated POST:

POST /action/1/snapshot HTTP/1.1
Host: motioneye-host:8765
Content-Length: 0

Observe {} (HTTP 200) response — snapshot triggered without any credentials

For action scripts (lock, unlock, alarm_on, alarm_off, light_on, etc.):

POST /action/1/alarm_on HTTP/1.1
Host: motioneye-host:8765

Impact

Unauthenticated attacker can trigger camera snapshots on demand
Unauthenticated attacker can start/stop video recording
If action scripts are configured by admin: attacker can trigger PTZ movement, alarm control, lighting changes — physical security bypass
Via remote cameras: SSRF by triggering action on a remote motionEye server

Verification

Dynamically confirmed on v0.43.1 in Docker lab — POST /action/2/snapshot with no credentials returns HTTP 200 {}. Server log shows the action was processed (failed only because motion daemon was not running for the test camera, not due to an auth rejection).

Recommended Fix

class ActionHandler(BaseHandler):
    @BaseHandler.auth()   # add authentication requirement
    async def post(self, camera_id, action):
        ...

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "motioneye"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.44.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55863"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-23T18:37:51Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `ActionHandler.post()` method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions including snapshots, recording start/stop, and configured action scripts (PTZ controls, alarm triggers, etc.).\n\n## Vulnerability Details\n\n**File**: `motioneye/handlers/action.py` \u2014 `ActionHandler.post()` line 36\n**CWE**: CWE-862 \u2014 Missing Authorization\n**CVSS**: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3 Medium\n\n### Vulnerable Code\n\n```python\nclass ActionHandler(BaseHandler):\n    async def post(self, camera_id, action):   # \u2190 NO @BaseHandler.auth() decorator\n        camera_id = int(camera_id)\n        if camera_id not in config.get_camera_ids():\n            raise HTTPError(404, \u0027no such camera\u0027)\n        ...\n        if action == \u0027snapshot\u0027:\n            await self.snapshot(camera_id)   # executed without auth\n            return\n        elif action == \u0027record_start\u0027:\n            return self.record_start(camera_id)\n        elif action == \u0027record_stop\u0027:\n            return self.record_stop(camera_id)\n\n        action_commands = config.get_action_commands(local_config)\n        command = action_commands.get(action)\n        ...\n        self.run_command_bg(command)   # executes predefined shell scripts\n```\n\nCompare with other handlers that correctly require authentication:\n\n```python\n@BaseHandler.auth(admin=True)   # \u2190 properly protected\nasync def delete(self, camera_id, filename):\n    ...\n```\n\n## Steps to Reproduce\n\n1. Deploy motionEye with at least one camera configured\n2. Send unauthenticated POST:\n\n```\nPOST /action/1/snapshot HTTP/1.1\nHost: motioneye-host:8765\nContent-Length: 0\n```\n\n3. Observe `{}` (HTTP 200) response \u2014 snapshot triggered without any credentials\n\nFor action scripts (`lock`, `unlock`, `alarm_on`, `alarm_off`, `light_on`, etc.):\n```\nPOST /action/1/alarm_on HTTP/1.1\nHost: motioneye-host:8765\n```\n\n## Impact\n\n- Unauthenticated attacker can trigger camera snapshots on demand\n- Unauthenticated attacker can start/stop video recording\n- If action scripts are configured by admin: attacker can trigger PTZ movement, alarm control, lighting changes \u2014 physical security bypass\n- Via remote cameras: SSRF by triggering action on a remote motionEye server\n\n## Verification\n\nDynamically confirmed on v0.43.1 in Docker lab \u2014 `POST /action/2/snapshot` with no credentials returns HTTP 200 `{}`. Server log shows the action was processed (failed only because motion daemon was not running for the test camera, not due to an auth rejection).\n\n## Recommended Fix\n\n```python\nclass ActionHandler(BaseHandler):\n    @BaseHandler.auth()   # add authentication requirement\n    async def post(self, camera_id, action):\n        ...\n```",
  "id": "GHSA-j67x-q29f-qcvv",
  "modified": "2026-06-23T18:37:51Z",
  "published": "2026-06-23T18:37:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/motioneye-project/motioneye"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "motionEye\u0027s missing authentication on ActionHandler allows unauthenticated camera action execution"
}

PYSEC-2026-2665

Vulnerability from pysec - Published: 2026-07-13 15:46 - Updated: 2026-07-13 16:04

Details

Summary

Vulnerability Details

File: motioneye/handlers/action.py — ActionHandler.post() line 36 CWE: CWE-862 — Missing Authorization CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3 Medium

Vulnerable Code

class ActionHandler(BaseHandler):
    async def post(self, camera_id, action):   # ← NO @BaseHandler.auth() decorator
        camera_id = int(camera_id)
        if camera_id not in config.get_camera_ids():
            raise HTTPError(404, 'no such camera')
        ...
        if action == 'snapshot':
            await self.snapshot(camera_id)   # executed without auth
            return
        elif action == 'record_start':
            return self.record_start(camera_id)
        elif action == 'record_stop':
            return self.record_stop(camera_id)

        action_commands = config.get_action_commands(local_config)
        command = action_commands.get(action)
        ...
        self.run_command_bg(command)   # executes predefined shell scripts

Compare with other handlers that correctly require authentication:

@BaseHandler.auth(admin=True)   # ← properly protected
async def delete(self, camera_id, filename):
    ...

Steps to Reproduce

Deploy motionEye with at least one camera configured
Send unauthenticated POST:

POST /action/1/snapshot HTTP/1.1
Host: motioneye-host:8765
Content-Length: 0

Observe {} (HTTP 200) response — snapshot triggered without any credentials

For action scripts (lock, unlock, alarm_on, alarm_off, light_on, etc.):

POST /action/1/alarm_on HTTP/1.1
Host: motioneye-host:8765

Impact

Unauthenticated attacker can trigger camera snapshots on demand
Unauthenticated attacker can start/stop video recording
If action scripts are configured by admin: attacker can trigger PTZ movement, alarm control, lighting changes — physical security bypass
Via remote cameras: SSRF by triggering action on a remote motionEye server

Verification

Recommended Fix

class ActionHandler(BaseHandler):
    @BaseHandler.auth()   # add authentication requirement
    async def post(self, camera_id, action):
        ...

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Impacted products

Name	purl
motioneye	pkg:pypi/motioneye

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "motioneye",
        "purl": "pkg:pypi/motioneye"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.44.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.27",
        "0.27.1",
        "0.27.2",
        "0.28",
        "0.28.1",
        "0.28.2",
        "0.28.3",
        "0.29",
        "0.29.1",
        "0.29rc1",
        "0.29rc2",
        "0.30",
        "0.30rc1",
        "0.30rc2",
        "0.31",
        "0.31.1",
        "0.31.2",
        "0.31.3",
        "0.31.4",
        "0.31.5",
        "0.32",
        "0.32.1",
        "0.32.2",
        "0.33",
        "0.33.1",
        "0.33.2",
        "0.33.3",
        "0.33.4",
        "0.34",
        "0.34.1",
        "0.34rc1",
        "0.35",
        "0.35.1",
        "0.35.2",
        "0.35rc1",
        "0.36",
        "0.36.1",
        "0.37",
        "0.37.1",
        "0.37rc1",
        "0.38",
        "0.38.1",
        "0.39",
        "0.39.1",
        "0.39.2",
        "0.39.3",
        "0.40",
        "0.40rc1",
        "0.40rc2",
        "0.40rc3",
        "0.40rc4",
        "0.40rc5",
        "0.41",
        "0.41rc1",
        "0.42",
        "0.42.1",
        "0.43.1",
        "0.43.1b1",
        "0.43.1b2",
        "0.43.1b3",
        "0.43.1b4",
        "0.43.1b5",
        "0.44.0b1",
        "0.44.0b2",
        "0.44.0b3"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55863",
    "GHSA-j67x-q29f-qcvv"
  ],
  "details": "## Summary\n\nThe `ActionHandler.post()` method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions including snapshots, recording start/stop, and configured action scripts (PTZ controls, alarm triggers, etc.).\n\n## Vulnerability Details\n\n**File**: `motioneye/handlers/action.py` \u2014 `ActionHandler.post()` line 36\n**CWE**: CWE-862 \u2014 Missing Authorization\n**CVSS**: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3 Medium\n\n### Vulnerable Code\n\n```python\nclass ActionHandler(BaseHandler):\n    async def post(self, camera_id, action):   # \u2190 NO @BaseHandler.auth() decorator\n        camera_id = int(camera_id)\n        if camera_id not in config.get_camera_ids():\n            raise HTTPError(404, \u0027no such camera\u0027)\n        ...\n        if action == \u0027snapshot\u0027:\n            await self.snapshot(camera_id)   # executed without auth\n            return\n        elif action == \u0027record_start\u0027:\n            return self.record_start(camera_id)\n        elif action == \u0027record_stop\u0027:\n            return self.record_stop(camera_id)\n\n        action_commands = config.get_action_commands(local_config)\n        command = action_commands.get(action)\n        ...\n        self.run_command_bg(command)   # executes predefined shell scripts\n```\n\nCompare with other handlers that correctly require authentication:\n\n```python\n@BaseHandler.auth(admin=True)   # \u2190 properly protected\nasync def delete(self, camera_id, filename):\n    ...\n```\n\n## Steps to Reproduce\n\n1. Deploy motionEye with at least one camera configured\n2. Send unauthenticated POST:\n\n```\nPOST /action/1/snapshot HTTP/1.1\nHost: motioneye-host:8765\nContent-Length: 0\n```\n\n3. Observe `{}` (HTTP 200) response \u2014 snapshot triggered without any credentials\n\nFor action scripts (`lock`, `unlock`, `alarm_on`, `alarm_off`, `light_on`, etc.):\n```\nPOST /action/1/alarm_on HTTP/1.1\nHost: motioneye-host:8765\n```\n\n## Impact\n\n- Unauthenticated attacker can trigger camera snapshots on demand\n- Unauthenticated attacker can start/stop video recording\n- If action scripts are configured by admin: attacker can trigger PTZ movement, alarm control, lighting changes \u2014 physical security bypass\n- Via remote cameras: SSRF by triggering action on a remote motionEye server\n\n## Verification\n\nDynamically confirmed on v0.43.1 in Docker lab \u2014 `POST /action/2/snapshot` with no credentials returns HTTP 200 `{}`. Server log shows the action was processed (failed only because motion daemon was not running for the test camera, not due to an auth rejection).\n\n## Recommended Fix\n\n```python\nclass ActionHandler(BaseHandler):\n    @BaseHandler.auth()   # add authentication requirement\n    async def post(self, camera_id, action):\n        ...\n```",
  "id": "PYSEC-2026-2665",
  "modified": "2026-07-13T16:04:59.252268Z",
  "published": "2026-07-13T15:46:23.552091Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/motioneye-project/motioneye"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/motioneye"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-j67x-q29f-qcvv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55863"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "motionEye\u0027s missing authentication on ActionHandler allows unauthenticated camera action execution"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55863 (GCVE-0-2026-55863)

FKIE_CVE-2026-55863

GHSA-J67X-Q29F-QCVV

Summary

Vulnerability Details

Vulnerable Code

Steps to Reproduce

Impact

Verification

Recommended Fix

PYSEC-2026-2665

Summary

Vulnerability Details

Vulnerable Code

Steps to Reproduce

Impact

Verification

Recommended Fix

Tags

Sightings

Nomenclature

Related by attack behaviour