CVE-2026-55863: motionEye Unauthenticated Action Execution Vulnerability
Summary
CVE-2026-55863: motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution. Affects motioneye versions < 0.44.0. Fixed in 0.44.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
motionEye is an open-source software that provides a web-based interface for managing IP cameras. It allows users to configure and control multiple cameras, view live feeds, and manage recordings. The software is widely used for surveillance and security purposes. However, a critical vulnerability has been identified that allows unauthenticated users to execute camera actions without proper authorization, potentially compromising security.
Vulnerability Detail
The vulnerability arises from the lack of authentication in the ActionHandler.post() method within motionEye. This oversight allows any unauthenticated attacker to trigger camera actions such as taking snapshots, starting or stopping recordings, and executing configured action scripts. The absence of an authentication decorator means that these actions can be performed without any credentials, leading to unauthorized access and control over the camera system. The potential ramifications include unauthorized surveillance, privacy violations, and physical security breaches.
How To Fix
Minimum fixed version
0.44.0
This is the first release that contains the fix.
pip install --upgrade "motioneye==0.44.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the motionEye web interface by implementing network-level security measures, such as firewalls or VPNs, to limit exposure to trusted users only.
Conclusion
The motionEye vulnerability CVE-2026-55863 poses a significant risk by allowing unauthorized access to camera actions. It is crucial for users to update to the latest version and implement security measures to safeguard their systems against potential exploitation.
See every vulnerability recorded for motioneye →
FAQ
CVE-2026-55863 is a vulnerability in motionEye that allows unauthenticated users to execute camera actions without authorization.
An attacker can trigger camera snapshots, start or stop video recordings, and execute configured action scripts, potentially compromising security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 5.3, indicating a medium severity level.
To protect your installation, update to the patched version (0.44.0 or later) and implement network security measures to restrict access.
References
Related vulnerabilities
Recent vulnerabilities recorded for motioneye.
