CVE-2026-72556: Zoneminder

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class, causing PHP __call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-based OS command execution regardless of their assigned role.

Affected products

• Zoneminder Zoneminder: up to and including 1.39.17

Published 2026-08-11. Last modified 2026-09-03.