id: PYSEC-2026-2666
published: "2026-07-13T15:46:22.482394Z"
modified: "2026-07-13T16:04:59.313500Z"
aliases:
- CVE-2026-32315
- GHSA-rhgp-6wq6-9j67
summary: motionEye's World-Readable Configuration File Exposes Admin Password Hash
details: "# Security Advisory: World-Readable Configuration File Exposes Admin Password Hash in motionEye\n\n## Summary\n\nmotionEye v0.43.1 and prior versions create the configuration file `/etc/motioneye/motion.conf` with `644` permissions (`-rw-r--r--`), making it readable by any local user on the system. This file contains sensitive data including the admin password hash, which can be leveraged by other vulnerabilities to escalate privileges.\n\n## Affected Versions\n\n- motionEye <= 0.43.1b4\n- Fixed in motionEye 0.44.0b1 (applies `0600` mode to `motion.conf` and `camera-*.conf` files)\n\n## Vulnerability Details\n\n### World-Readable Configuration File (CWE-732)\n\nWhen motionEye writes its configuration, the file `/etc/motioneye/motion.conf` is created with `644` permissions regardless of the installation method. This file contains the admin password hash in the `@admin_password` field:\n\n```\n# @admin_username admin\n# @admin_password c18006fc138809314751cd1991f1e0b820fabd37\n```\n\nAny local user can read this hash without elevated privileges:\n\n```bash\n$ sudo -u testuser cat /etc/motioneye/motion.conf\n# @admin_password c18006fc138809314751cd1991f1e0b820fabd37\n```\n\nAdditionally, per-camera configuration files (`camera-*.conf`) are also created with the same `644` permissions, potentially exposing camera-specific credentials and settings.\n\n## Impact\n\nThe exposed admin password hash enables several attack paths:\n\n- **Offline password cracking:** The SHA1 hash can be cracked to recover the plaintext admin password\n- **Authentication bypass:** When combined with the signature authentication weakness (see GHSA-45h7-499j-7ww3), the hash can be used directly to forge authenticated admin API requests\n- **Full system compromise:** When further chained with CVE-2025-60787 (OS command injection), a local unprivileged user can escalate to the Motion daemon user (often root)\n\n## Proof of Concept\n\nThe following demonstrates that an unprivileged user can read the admin password hash from the config file and verify it matches the admin's password:\n\n```bash\n# Verify the file permissions\n$ ls -la /etc/motioneye/motion.conf\n-rw-r--r-- 1 motion motion 255 Mar 11 15:42 /etc/motioneye/motion.conf\n\n# Read the hash as an unprivileged user\n$ sudo -u testuser cat /etc/motioneye/motion.conf | grep admin_password\n# @admin_password c18006fc138809314751cd1991f1e0b820fabd37\n\n# Verify the hash matches the admin password (SHA1)\n$ sudo -u testuser python3 -c \"import hashlib; print(hashlib.sha1(b'testpassword123').hexdigest())\"\nc18006fc138809314751cd1991f1e0b820fabd37\n```\n\n### Verified Output\n\nThe following output was captured on a fresh motionEye v0.43.1b4 installation (official `motioneye_init` method, admin password set to `testpassword123`):\n\n```\n$ ls -la /etc/motioneye/motion.conf\n-rw-r--r-- 1 motion motion 255 Mar 11 15:42 /etc/motioneye/motion.conf\n\n$ sudo -u testuser cat /etc/motioneye/motion.conf | grep admin_password\n# @admin_password c18006fc138809314751cd1991f1e0b820fabd37\n\n$ sudo -u testuser python3 -c \"import hashlib; print(hashlib.sha1(b'testpassword123').hexdigest())\"\nc18006fc138809314751cd1991f1e0b820fabd37\n```\n\nThe hash extracted by the unprivileged `testuser` matches the SHA1 of the admin password, confirming full credential exposure.\n\n## Reproduction Steps\n\nThis vulnerability has been tested and confirmed with both installation methods described in the official motionEye documentation.\n\n### Method 1: Manual Installation\n\n1. Install motionEye on a Linux system:\n   ```bash\n   sudo pip install motioneye\n   mkdir -p /etc/motioneye /var/log/motioneye /var/lib/motioneye /run/motioneye\n   cp /usr/local/lib/python3.12/dist-packages/motioneye/extra/motioneye.conf.sample /etc/motioneye/motioneye.conf\n   sudo meyectl startserver -c /etc/motioneye/motioneye.conf\n   ```\n\n2. Set an admin password via the web UI at `http://localhost:8765`\n\n3. Verify the config file is world-readable:\n   ```bash\n   ls -la /etc/motioneye/motion.conf\n   # -rw-r--r-- 1 root root 255 ... /etc/motioneye/motion.conf\n   ```\n\n4. As an unprivileged user, read the hash:\n   ```bash\n   sudo -u testuser cat /etc/motioneye/motion.conf\n   # @admin_password c18006fc138809314751cd1991f1e0b820fabd37\n   ```\n\n### Method 2: Official `motioneye_init` Installation\n\n1. Install motionEye using the official init script:\n   ```bash\n   sudo pip install motioneye\n   sudo motioneye_init\n   ```\n\n2. The `motioneye_init` script automatically creates the required directories, installs the systemd service, and starts motionEye. Set an admin password via the web UI at `http://localhost:8765`\n\n3. Verify the config file is still world-readable:\n   ```bash\n   ls -la /etc/motioneye/motion.conf\n   # -rw-r--r-- 1 motion motion 255 ... /etc/motioneye/motion.conf\n   ```\n\n   Note that while the ownership changes to `motion:motion` (instead of `root:root` in the manual method), the permissions remain `644`, meaning any local user can still read the file.\n\n4. Confirm as an unprivileged user:\n   ```bash\n   sudo -u testuser cat /etc/motioneye/motion.conf\n   # @admin_password c18006fc138809314751cd1991f1e0b820fabd37\n   ```\n\nBoth installation methods produce the same vulnerable state, confirming this is the default behavior of the software and not a user misconfiguration.\n\n## Related Vulnerabilities\n\n- **GHSA-45h7-499j-7ww3:** Password hash accepted as API signing key (CWE-836), which allows the hash exposed by this vulnerability to be used for forging authenticated admin API requests\n- **CVE-2025-60787:** OS command injection via `image_file_name`, which requires admin authentication. When chained with both this vulnerability and GHSA-45h7-499j-7ww3, enables local privilege escalation to root\n\n## Suggested Remediation\n\n1. **Fix file permissions:** Create `motion.conf` and `camera-*.conf` with `600` permissions (`-rw-------`), readable only by the motionEye service user (addressed in motionEye 0.44.0b1)\n\n## Timeline\n\n- **2026-03-11:** Vulnerability discovered during security research\n- **2026-03-11:** Vendor notified via GitHub Security Advisory\n- **2026-03-12:** Vendor acknowledged, confirmed fix in motionEye 0.44.0b1"
affected:
- package:
    name: motioneye
    ecosystem: PyPI
    purl: pkg:pypi/motioneye
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.44.0
  versions:
  - "0.27"
  - 0.27.1
  - 0.27.2
  - "0.28"
  - 0.28.1
  - 0.28.2
  - 0.28.3
  - "0.29"
  - 0.29.1
  - 0.29rc1
  - 0.29rc2
  - "0.30"
  - 0.30rc1
  - 0.30rc2
  - "0.31"
  - 0.31.1
  - 0.31.2
  - 0.31.3
  - 0.31.4
  - 0.31.5
  - "0.32"
  - 0.32.1
  - 0.32.2
  - "0.33"
  - 0.33.1
  - 0.33.2
  - 0.33.3
  - 0.33.4
  - "0.34"
  - 0.34.1
  - 0.34rc1
  - "0.35"
  - 0.35.1
  - 0.35.2
  - 0.35rc1
  - "0.36"
  - 0.36.1
  - "0.37"
  - 0.37.1
  - 0.37rc1
  - "0.38"
  - 0.38.1
  - "0.39"
  - 0.39.1
  - 0.39.2
  - 0.39.3
  - "0.40"
  - 0.40rc1
  - 0.40rc2
  - 0.40rc3
  - 0.40rc4
  - 0.40rc5
  - "0.41"
  - 0.41rc1
  - "0.42"
  - 0.42.1
  - 0.43.1
  - 0.43.1b1
  - 0.43.1b2
  - 0.43.1b3
  - 0.43.1b4
  - 0.43.1b5
  - 0.44.0b1
  - 0.44.0b2
  - 0.44.0b3
references:
- type: WEB
  url: https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rhgp-6wq6-9j67
- type: PACKAGE
  url: https://github.com/motioneye-project/motioneye
- type: PACKAGE
  url: https://pypi.org/project/motioneye
- type: ADVISORY
  url: https://github.com/advisories/GHSA-rhgp-6wq6-9j67
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-32315
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N