CVE-2026-32315

Name of the Vulnerable Software and Affected Versions motionEye versions prior to 0.44.0

Description Configuration files /etc/motioneye/motion.conf and camera-*.conf are created with 644 permissions, making them readable by any local user on the system. The motion.conf file contains sensitive data, specifically the admin password hash in the @admin password field. This SHA1 hash can be cracked offline to recover the plaintext password or used directly to forge authenticated admin API requests. When combined with other flaws, such as OS command injection, a local unprivileged user can escalate privileges to the Motion daemon user, which often has root access, leading to full system compromise.

Recommendations Update to version 0.44.0 or later to ensure configuration files are created with 0600 permissions. As a temporary workaround, manually change the permissions of /etc/motioneye/motion.conf and /etc/motioneye/camera-*.conf to 600 to restrict access to the service user.