CVE-2026-72556

Name of the Vulnerable Software and Affected Versions ZoneMinder version 1.39.17

Description An authenticated user can execute OS commands due to a broken permission check within the Filter class. The canEdit() and canDelete() functions call nonexistent methods on the ZMUser class, which triggers the PHP call() magic method. This results in a truthy return value that bypasses permission checks for all users, allowing any authenticated user to trigger filter-based OS command execution regardless of their assigned role.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.