CVE-2026-55863: motionEye Unauthenticated Camera Action Execution Vulnerability
Summary
CVE-2026-55863: motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution. Affects motioneye versions < 0.44.0. Fixed in 0.44.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
motionEye is an open-source software that provides a web-based interface for managing IP cameras. It allows users to configure and control multiple cameras, enabling features such as motion detection, recording, and snapshots. However, a critical vulnerability exists in the ActionHandler component, which lacks proper authentication, exposing users to potential unauthorized actions.
Vulnerability Detail
The vulnerability arises from the absence of an authentication decorator in the ActionHandler.post() method of motionEye. This oversight allows unauthenticated attackers to execute camera actions, including taking snapshots, starting or stopping recordings, and triggering configured action scripts. The lack of authorization can lead to significant security risks, such as unauthorized access to camera feeds and control over physical security measures. The vulnerability is classified under CWE-862, indicating a missing authorization issue, and has a CVSS score of 5.3, categorizing it as a medium severity risk.
How To Fix
Minimum fixed version
0.44.0
This is the first release that contains the fix.
pip install --upgrade "motioneye==0.44.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate this vulnerability other than updating to the patched version. However, restricting network access to the motionEye server can help reduce exposure to unauthorized users.
Conclusion
The CVE-2026-55863 vulnerability in motionEye poses a significant risk due to its lack of authentication for camera actions. Users are strongly advised to update to the latest version to mitigate potential unauthorized access and control over their camera systems.
See every vulnerability recorded for motioneye →
FAQ
CVE-2026-55863 is a vulnerability in motionEye that allows unauthenticated users to execute camera actions without proper authorization.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
An attacker can take snapshots, start or stop recordings, and trigger configured action scripts, potentially compromising physical security.
The vulnerability has a CVSS score of 5.3, indicating a medium severity risk.
If you cannot update immediately, consider restricting access to the motionEye server to trusted users only to minimize the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for motioneye.
