CVE-2026-55863

motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post() method in motioneye/handlers/action.py lacks the BaseHandler.auth() decorator, allowing an unauthenticated remote attacker to send requests to /action/<camera_id>/<action>. The endpoint can trigger snapshot, record_start, and record_stop actions. When an administrator has configured action scripts, the same endpoint can invoke PTZ controls, alarm actions, lighting actions, and other predefined commands, and configured remote motionEye cameras can allow server-side requests to the remote camera service. This issue is fixed in version 0.44.0.

• CWE-862

• https://github.com/motioneye-project/motioneye/commit/0d5cb9c238a87447dae29812e5bf2ccf323cf3dc
• https://github.com/motioneye-project/motioneye/pull/3332
• https://github.com/motioneye-project/motioneye/releases/tag/0.44.0
• https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv
• https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv

Published

Sep 15, 2026

Last Modified

Sep 16, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55856MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-55857MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-55858MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-55859MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL …5.9
• CVE-2026-5586A vulnerability was determined in zhongyu09 openchatbi up to…6.3
• CVE-2026-55860MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL …5.9
• CVE-2026-55864GeoNetwork is a catalog application to manage spatially refe…7.8
• CVE-2026-55865Python Liquid is a Python engine for the Liquid template lan…7.1
• CVE-2026-55866SpiceDB is an open source database system for creating and m…3.7
• CVE-2026-55867Graylog is a free and open log management platform. From 6.2…5.3
• CVE-2026-5587A vulnerability was identified in wbbeyourself MAC-SQL up to…6.3
• CVE-2026-55870GoCD is a continuous deliver server. Prior to 26.1.0, GoCD c…2.3