CVE-2026-72556

CVE-2026-72556 in ZoneMinder's filter module allows any authenticated user—including guest accounts—to execute arbitrary commands. The root cause is not a classic injection flaw but a broken authorization primitive: the ZM\User class's __call() magic method returns a truthy value for undefined method calls, which causes permission checks like canEdit() and canDelete() to pass unconditionally regardless of the user's role. When code calls $user->canEdit() or $user->canDelete() on a user object, PHP invokes __call() for these undefined methods. If __call() returns any truthy value—a default property, a non-null result—the permission check treats it as authorized. The developer almost certainly expected these calls to either return false for unauthorized users or throw an error for undefined methods. Instead, every authenticated user gets silent approval. This fundamentally changes the threat model. The CVSS score of 8.8 reflects remote code execution impact, but the exploitability dimension undersells the operational risk. Any valid login suffices—no elevated privileges, no special conditions. Guest accounts, newly registered users, and compromised low-privilege credentials all trigger the same bypass. Your immediate actions: first, verify whether your ZoneMinder instance exposes the filter module to authenticated users and whether guest access is enabled. Second, audit your codebase for other permission checks that rely on canView(), canCreate(), or custom role methods that may depend on the same __call() pattern—if canEdit() is broken, assume the entire permission layer is suspect. Third, add a static analysis rule (Psalm, PHPStan) to flag truthy returns from __call() in conditional contexts. Fourth, check for other magic-method delegations in authorization code that may have quietly become dangerous as the codebase evolved. The attack surface isn't just the filter module—it's every code path passing through these broken permission primitives. Treat this as a systemic authorization failure, not an isolated bug.

Reviewed through automated stages and approved by a human before publication.