Skip to content

spupuz/VibeNVR

v1.14.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 4mo Media Servers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

ffmpeg lightweight local-storage nvr opensource privacy
+1 more
video-surveillance

Affected surfaces

auth rbac

Summary

AI summary

Added bulk camera deletion, duplicate detection, and full‑screen import overlay.

Full changelog

Full Changelog: https://github.com/spupuz/VibeNVR/compare/v1.14.0...v1.14.1

🚀 Release Notes v1.14.1

✨ New Features

Bulk Camera Management

  • Mass Deletion: You can now select multiple cameras for bulk deletion.
  • Bulk Actions Bar: Automatically appears when selecting 2 or more cameras.

Intelligent Duplicate Detection

  • Added advanced logic to extract Host/IP from RTSP URLs.
  • The system now skips duplicate cameras during JSON or MotionEye imports, even when stream paths differ.

Enhanced UI Feedback

  • Introduced a full‑screen processing overlay with dynamic icons and messages
    (e.g., “Importing Data…”, “Deleting Cameras…”) for long-running operations.

Precise Selection System

  • Camera selection is now restricted to a dedicated checkbox, preventing accidental selections when clicking Edit/Delete.

🐛 Bug Fixes & Improvements

Modal Persistence Fix

  • Resolved an issue where RTSP fields (Username, Password, Host) would clear after clicking Apply in the edit modal.

User Registration Patch

  • Fixed a potential 500 Server Error when creating a user with a duplicate email.
    The system now correctly returns 400 Bad Request.

Security Hardening

  • The Bulk Actions bar and sensitive RTSP details are now hidden from Read‑Only users.
  • Added server-side admin verification for all new bulk and import endpoints.
  • Log Masking: Passwords in RTSP transition URLs are now masked with asterisks in backend logs.

🛠️ Technical Internal Changes

  • Integrated urllib.parse for more robust Host/IP extraction.
  • Added new API endpoint:
    POST /api/cameras/bulk-delete with cascade cleanup of media files.
  • Improved MotionEye backup parsing to better handle split credentials (netcam_userpass).

Security Fixes

  • Hides Bulk Actions bar and RTSP details from Read‑Only users; adds server‑side admin verification for bulk/import endpoints; masks RTSP passwords in backend logs

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track spupuz/VibeNVR

Get notified when new releases ship.

Sign up free

About spupuz/VibeNVR

All releases →

Related context

Earlier breaking changes

  • v1.28.3 Must update docker-compose.yml with TZ variable for all services

Beta — feedback welcome: [email protected]