{"id":"PYSEC-2026-2665","summary":"motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution","details":"## Summary\n\nThe `ActionHandler.post()` method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions including snapshots, recording start/stop, and configured action scripts (PTZ controls, alarm triggers, etc.).\n\n## Vulnerability Details\n\n**File**: `motioneye/handlers/action.py` — `ActionHandler.post()` line 36\n**CWE**: CWE-862 — Missing Authorization\n**CVSS**: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3 Medium\n\n### Vulnerable Code\n\n```python\nclass ActionHandler(BaseHandler):\n    async def post(self, camera_id, action):   # ← NO @BaseHandler.auth() decorator\n        camera_id = int(camera_id)\n        if camera_id not in config.get_camera_ids():\n            raise HTTPError(404, 'no such camera')\n        ...\n        if action == 'snapshot':\n            await self.snapshot(camera_id)   # executed without auth\n            return\n        elif action == 'record_start':\n            return self.record_start(camera_id)\n        elif action == 'record_stop':\n            return self.record_stop(camera_id)\n\n        action_commands = config.get_action_commands(local_config)\n        command = action_commands.get(action)\n        ...\n        self.run_command_bg(command)   # executes predefined shell scripts\n```\n\nCompare with other handlers that correctly require authentication:\n\n```python\n@BaseHandler.auth(admin=True)   # ← properly protected\nasync def delete(self, camera_id, filename):\n    ...\n```\n\n## Steps to Reproduce\n\n1. Deploy motionEye with at least one camera configured\n2. Send unauthenticated POST:\n\n```\nPOST /action/1/snapshot HTTP/1.1\nHost: motioneye-host:8765\nContent-Length: 0\n```\n\n3. Observe `{}` (HTTP 200) response — snapshot triggered without any credentials\n\nFor action scripts (`lock`, `unlock`, `alarm_on`, `alarm_off`, `light_on`, etc.):\n```\nPOST /action/1/alarm_on HTTP/1.1\nHost: motioneye-host:8765\n```\n\n## Impact\n\n- Unauthenticated attacker can trigger camera snapshots on demand\n- Unauthenticated attacker can start/stop video recording\n- If action scripts are configured by admin: attacker can trigger PTZ movement, alarm control, lighting changes — physical security bypass\n- Via remote cameras: SSRF by triggering action on a remote motionEye server\n\n## Verification\n\nDynamically confirmed on v0.43.1 in Docker lab — `POST /action/2/snapshot` with no credentials returns HTTP 200 `{}`. Server log shows the action was processed (failed only because motion daemon was not running for the test camera, not due to an auth rejection).\n\n## Recommended Fix\n\n```python\nclass ActionHandler(BaseHandler):\n    @BaseHandler.auth()   # add authentication requirement\n    async def post(self, camera_id, action):\n        ...\n```","aliases":["CVE-2026-55863","GHSA-j67x-q29f-qcvv"],"modified":"2026-07-13T16:32:39.630246400Z","published":"2026-07-13T15:46:23.552091Z","references":[{"type":"WEB","url":"https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j67x-q29f-qcvv"},{"type":"PACKAGE","url":"https://github.com/motioneye-project/motioneye"},{"type":"PACKAGE","url":"https://pypi.org/project/motioneye"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-j67x-q29f-qcvv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55863"}],"affected":[{"package":{"name":"motioneye","ecosystem":"PyPI","purl":"pkg:pypi/motioneye"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.44.0"}]}],"versions":["0.27","0.27.1","0.27.2","0.28","0.28.1","0.28.2","0.28.3","0.29","0.29.1","0.29rc1","0.29rc2","0.30","0.30rc1","0.30rc2","0.31","0.31.1","0.31.2","0.31.3","0.31.4","0.31.5","0.32","0.32.1","0.32.2","0.33","0.33.1","0.33.2","0.33.3","0.33.4","0.34","0.34.1","0.34rc1","0.35","0.35.1","0.35.2","0.35rc1","0.36","0.36.1","0.37","0.37.1","0.37rc1","0.38","0.38.1","0.39","0.39.1","0.39.2","0.39.3","0.40","0.40rc1","0.40rc2","0.40rc3","0.40rc4","0.40rc5","0.41","0.41rc1","0.42","0.42.1","0.43.1","0.43.1b1","0.43.1b2","0.43.1b3","0.43.1b4","0.43.1b5","0.44.0b1","0.44.0b2","0.44.0b3"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/motioneye/PYSEC-2026-2665.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}