Detections
Analytics

SCA: security update for motioneye (GHSA-j67x-q29f-qcvv)

medium Tenable Self-Hosted Container Security Plugin ID 443802

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - motionEye (mEye) is an online interface for a piece of software called "motion," which is a video
 surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post() method in
 motioneye/handlers/action.py lacks the BaseHandler.auth() decorator, allowing an unauthenticated remote
 attacker to send requests to /action/<camera_id>/<action>. The endpoint can trigger snapshot,
 record_start, and record_stop actions. When an administrator has configured action scripts, the same
 endpoint can invoke PTZ controls, alarm actions, lighting actions, and other predefined commands, and
 configured remote motionEye cameras can allow server-side requests to the remote camera service. This
 issue is fixed in version 0.44.0. (CVE-2026-55863)

Solution

Update the motioneye library and its related packages to version 0.44.0 or later.

See Also

https://github.com/advisories/GHSA-j67x-q29f-qcvv

Plugin Details

Severity: Medium

ID: 443802

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 6/23/2026

Updated: 9/16/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-55863

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/23/2026

Vulnerability Publication Date: 6/23/2026

Reference Information

CVE: CVE-2026-55863

cwe: CWE-862