{"id":"CVE-2026-55863","aliases":["GHSA-j67x-q29f-qcvv","PYSEC-2026-2665"],"url":"https://o3.security/vulnerability/CVE-2026-55863","summary":"motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution","details":"## Summary\n\nThe `ActionHandler.post()` method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions including snapshots, recording start/stop, and configured action scripts (PTZ controls, alarm triggers, etc.).\n\n## Vulnerability Details\n\n**File**: `motioneye/handlers/action.py` — `ActionHandler.post()` line 36\n**CWE**: CWE-862 — Missing Authorization\n**CVSS**: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3 Medium\n\n### Vulnerable Code\n\n```python\nclass ActionHandler(BaseHandler):\n    async def post(self, camera_id, action):   # ← NO @BaseHandler.auth() decorator\n        camera_id = int(camera_id)\n        if camera_id not in config.get_camera_ids():\n            raise HTTPError(404, 'no such camera')\n        ...\n        if action == 'snapshot':\n            await self.snapshot(camera_id)   # executed without auth\n            return\n        elif action == 'record_start':\n            return self.record_start(camera_id)\n        elif action == 'record_stop':\n            return self.record_stop(camera_id)\n\n        action_commands = config.get_action_commands(local_config)\n        command = action_commands.get(action)\n        ...\n        self.run_command_bg(command)   # executes predefined shell scripts\n```\n\nCompare with other handlers that correctly require authentication:\n\n```python\n@BaseHandler.auth(admin=True)   # ← properly protected\nasync def delete(self, camera_id, filename):\n    ...\n```\n\n## Steps to Reproduce\n\n1. Deploy motionEye with at least one camera configured\n2. Send unauthenticated POST:\n\n```\nPOST /action/1/snapshot HTTP/1.1\nHost: motioneye-host:8765\nContent-Length: 0\n```\n\n3. Observe `{}` (HTTP 200) response — snapshot triggered without any credentials\n\nFor action scripts (`lock`, `unlock`, `alarm_on`, `alarm_off`, `light_on`, etc.):\n```\nPOST /action/1/alarm_on HTTP/1.1\nHost: motioneye-host:8765\n```\n\n## Impact\n\n- Unauthenticated attacker can trigger camera snapshots on demand\n- Unauthenticated attacker can start/stop video recording\n- If action scripts are configured by admin: attacker can trigger PTZ movement, alarm control, lighting changes — physical security bypass\n- Via remote cameras: SSRF by triggering action on a remote motionEye server\n\n## Verification\n\nDynamically confirmed on v0.43.1 in Docker lab — `POST /action/2/snapshot` with no credentials returns HTTP 200 `{}`. Server log shows the action was processed (failed only because motion daemon was not running for the test camera, not due to an auth rejection).\n\n## Recommended Fix\n\n```python\nclass ActionHandler(BaseHandler):\n    @BaseHandler.auth()   # add authentication requirement\n    async def post(self, camera_id, action):\n        ...\n```","published":"2026-09-15T16:46:41.756Z","modified":"2026-10-28T02:30:44.614103531Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":{"score":0.00289,"percentile":0.216,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"motioneye","fixedVersion":"0.44.0"}],"fix":{"url":"https://github.com/motioneye-project/motioneye/commit/0d5cb9c238a87447dae29812e5bf2ccf323cf3dc","label":"motioneye-project/motioneye@0d5cb9c"},"references":[{"type":"WEB","url":"https://github.com/motioneye-project/motioneye/releases/tag/0.44.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55863.json"},{"type":"ADVISORY","url":"https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55863"},{"type":"FIX","url":"https://github.com/motioneye-project/motioneye/commit/0d5cb9c238a87447dae29812e5bf2ccf323cf3dc"},{"type":"FIX","url":"https://github.com/motioneye-project/motioneye/pull/3332"},{"type":"PACKAGE","url":"https://github.com/motioneye-project/motioneye"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:44.614103531Z"}}