motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.
Summary
motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post() method in motioneye/handlers/action.py lacks the BaseHandler.auth() decorator, allowing an unauthenticated remote attacker to send requests to /action/<camera_id>/<action>. The endpoint can trigger snapshot, record_start, and record_stop actions. When an administrator has configured action scripts, the same endpoint can invoke PTZ controls, alarm actions, lighting actions, and other predefined commands, and configured remote motionEye cameras can allow server-side requests to the remote camera service. This issue is fixed in version 0.44.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| motioneye-project | motioneye | before 0.44.0 | 0.44.0 | Patch available | CNA |
| — | motioneye (PyPI) | before 0.44.0 | 0.44.0 | Patch available | GHSA-j67x-q29f-qcvv |
- motioneye Vendormotioneye-project Affected before 0.44.0 Fixed in 0.44.0 Patch available CNA
- motioneye (PyPI) Vendor— Affected before 0.44.0 Fixed in 0.44.0 Patch available GHSA-j67x-q29f-qcvv
Remediation
- Fix · CNA motioneye (motioneye-project) Fixed in 0.44.0
- Fix · GHSA-j67x-q29f-qcvv motioneye (PyPI) Fixed in 0.44.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55863
- 2026-10-03 Alias added: GHSA-j67x-q29f-qcvv
References
Other 5
- https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv
- https://github.com/motioneye-project/motioneye/pull/3332
- https://github.com/motioneye-project/motioneye/commit/0d5cb9c238a87447dae29812e5bf2ccf323cf3dc
- https://github.com/motioneye-project/motioneye/releases/tag/0.44.0
- https://github.com/motioneye-project/motioneye
More motioneye-project vulnerabilities
- TI-2026-34187 motionEye: Authentication possible via password hash CVSS 4.0CRITICAL 9.1
- TI-2025-30247 motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution CVSS 4.0HIGH 8.9
- TI-2026-40043 motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read CVSS 4.0HIGH 7.7
- TI-2025-37818 MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration… CVSS 3.1HIGH 7.2
- TI-2026-24521 motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint CVSS 3.1MEDIUM 6.5
- TI-2026-24843 motionEye: World-Readable Configuration File Exposes Admin Password Hash CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-55863 · CVE Program
- CVE-2026-55863 · NVD
- FIRST EPSS
- GHSA-j67x-q29f-qcvv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences