{"cve":"CVE-2026-55863","nvd":{"published":"2026-09-15T17:17:22.967","modified":"2026-09-30T17:51:56.193","status":"Deferred","description":"motionEye (mEye) is an online interface for a piece of software called \"motion,\" which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post() method in motioneye/handlers/action.py lacks the BaseHandler.auth() decorator, allowing an unauthenticated remote attacker to send requests to /action/<camera_id>/<action>. The endpoint can trigger snapshot, record_start, and record_stop actions. When an administrator has configured action scripts, the same endpoint can invoke PTZ controls, alarm actions, lighting actions, and other predefined commands, and configured remote motionEye cameras can allow server-side requests to the remote camera service. This issue is fixed in version 0.44.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3},"cwes":["CWE-862"],"references":["https://github.com/motioneye-project/motioneye/commit/0d5cb9c238a87447dae29812e5bf2ccf323cf3dc","https://github.com/motioneye-project/motioneye/pull/3332","https://github.com/motioneye-project/motioneye/releases/tag/0.44.0","https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv","https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-55863","score":0.00496,"percentile":0.42246,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-j67x-q29f-qcvv","url":"https://osv.dev/vulnerability/GHSA-j67x-q29f-qcvv","summary":"motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution","modified":"2026-07-13T16:43:03.503060520Z","packages":[{"ecosystem":"PyPI","name":"motioneye","purl":"pkg:pypi/motioneye","ranges":["<0.44.0"],"fixed":["0.44.0"]}]},{"id":"PYSEC-2026-2665","url":"https://osv.dev/vulnerability/PYSEC-2026-2665","summary":"motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution","modified":"2026-07-13T16:32:39.630246400Z","packages":[{"ecosystem":"PyPI","name":"motioneye","purl":"pkg:pypi/motioneye","ranges":["<0.44.0"],"fixed":["0.44.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}