CVE-2026-32315 Details
Description
motionEye (mEye) is an online interface for motion software, a video surveillance program with motion detection. Versions prior to 0.44.0 create the configuration file /etc/motioneye/motion.conf with 644 permissions (-rw-r--r--), making it readable by any local user on the system. This file contains sensitive data including the admin password hash, which can be leveraged by other vulnerabilities to escalate privileges. Additionally, per-camera configuration files (camera-*.conf) are also created with the same 644 permissions, potentially exposing camera-specific credentials and settings. The exposed SHA1 admin password hash can be cracked offline to recover the plaintext password, used directly to forge authenticated admin API requests via the signature authentication weakness (GHSA-45h7-499j-7ww3), and chained with the OS command injection flaw (CVE-2025-60787) to escalate a local unprivileged user to the Motion daemon user (often root), enabling full system compromise. This issue has been fixed in version 0.44.0.
A vulnerability in motionEye versions prior to 0.44.0 allows the configuration file '/etc/motioneye/motion.conf' to be created with permissions that make it readable by all local users. This file contains sensitive information, including the admin password hash, which can be exploited to escalate privileges. The issue also affects per-camera configuration files, which are similarly exposed. The vulnerability arises because the application defaults to creating these files with 644 permissions, leaving them accessible to any local user.
Users are advised to update to motionEye version 0.44.0 or later, which addresses the vulnerability by changing the file permissions of the main and per-camera configuration files to '600', restricting access to only the motionEye service user.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rhgp-6wq6-9j67 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/motioneye-project/motioneye/releases/tag/0.44.0 | [email protected] | Release NotesVendor |
| https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rhgp-6wq6-9j67 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| motionEye | <= 0.43.1b4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |