LoginSign Up
← Back to all sparks
Z

ZoneMinder

INFRA · APIS
Velocity2.5

Video surveillance and CCTV management system

zoneminder.com ↗

1.38.4 is a security release in all but name, closing ACL gaps across the API.

security-hardeningrbacapi-authorizationmaintenance-branchonvif
◆Current state
The 1.38 line is in maintenance, and 1.38.4 is almost entirely authorization work: per-monitor access control enforced on event, frame, zone, tag and media endpoints, two auth bypasses fixed in token validation, and SQL injection and overflow hardening. The 1.36 branch still receives backports, with 1.36.38 carrying its own SQL injection fix. The last feature release was 1.38.0 in February, which brought role-based access control, WebRTC and Go2RTC streaming, and the split of monitor function into separate capturing, analysing, and recording settings.
◆Where it's heading
Every release since 1.38.0 has been consolidation of what that release opened up. RBAC shipped as a headline feature in February, and the four maintenance drops since have been finding the endpoints it did not cover — the familiar pattern when a permission model is retrofitted onto an API that predates it. Cadence is slow and irregular, months apart, with a 1.39 spec bump already visible in the repo but nothing from that series shipped.
◆Prediction
Expect more per-endpoint ACL fixes on the 1.38 line before anything from 1.39 reaches release.

◆Recent moves

  1. 8d ago

    1.38.4 closes API ACL gaps and two auth bypasses

    Per-monitor access control is now enforced on the EventData, Tags, and Frames controllers and on direct event, frame, zone, and media endpoints, with two token-validation auth bypasses fixed alongside it. Filed as a maintenance release, but it is the largest authorization sweep since RBAC arrived in 1.38.0.

    View source ↗
  2. 2mo ago

    1.38.3 supersedes 1.38.2 with RBAC and injection fixes

    The same pattern one release earlier: RBAC checks added to ConfigsController, command injection closed in the monitor device path, and URLs escaped in camera presets. It also replaces 1.38.2, which was tagged but never shipped after Debian packaging hit a cross-distro tarball conflict.

    View source ↗
  3. 2mo ago

    chore: bump redhat spec version to 1.39.11

    A packaging chore syncing the RedHat spec file to version.txt after a security release. No functional change.

    View source ↗
  4. 6mo ago

    1.36.38 backports a SQL injection fix to the legacy branch

    The legacy 1.36 branch gets its own SQL injection fix in stored event name and cause fields, plus rotation-aware default zone creation and timezone handling fixes. Keeping security backports flowing to a branch two minor versions behind says a lot about how slowly self-hosted CCTV installs upgrade.

    View source ↗
  5. 6mo ago

    1.38.1 unifies four ONVIF control modules into one

    Four vendor-specific ONVIF implementations collapse into one control module, with SSL verification fallback for self-signed certificates and a configurable clock-drift window. Consolidating camera control code is the kind of cleanup that makes the next round of protocol work cheaper.

    View source ↗
  6. 6mo ago

    1.38.0 adds RBAC, WebRTC streaming, and a monitor function split

    ⚡ SPARK

    The release everything since has been servicing: RBAC, modern streaming, and the monitor function split all landed here, and the four maintenance drops that followed have been closing the gaps it left. It remains the reference point for where this product is going.

    View source ↗