spupuz/VibeNVR

v1.28.7 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 10d Media Servers

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ffmpeg lightweight local-storage nvr opensource privacy

+1 more

video-surveillance

Affected surfaces

auth rbac rce_ssrf

ReleasePort's take

Light signal

editorial:auto 10d

Release v1.28.7 introduces per‑camera retention policies and precise storage dashboards, while enhancing security via log redaction and tightening PyAV engine checks.

Why it matters: Security improvements (log redaction, hardened PyAV) mitigate credential exposure; new retention policies and dashboard precision help operators manage resources more accurately in v1.28.7 deployments.

Summary

AI summary

Updates 🛠️ Key Improvements, 🚀 Release v1.28.7, and RBAC across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Medium	Implements system‑wide log redaction to mask tokens and passwords instantly. Implements system‑wide log redaction to mask tokens and passwords instantly. Source: llm_adapter@2026-05-24 Confidence: high	—
Security	Medium	Hardens PyAV engine pre‑flight checks and strengthens SSRF/Path Traversal protections. Hardens PyAV engine pre‑flight checks and strengthens SSRF/Path Traversal protections. Source: llm_adapter@2026-05-24 Confidence: high	—
Feature
Feature	Medium	Adds per-camera custom retention policies for storage engine. Adds per-camera custom retention policies for storage engine. Source: llm_adapter@2026-05-24 Confidence: high	—
Feature	Medium	Updates Storage Dashboard to show exact capacity and required storage estimates down to 0.01 GB. Updates Storage Dashboard to show exact capacity and required storage estimates down to 0.01 GB. Source: llm_adapter@2026-05-24 Confidence: high	—
Feature	Medium	Deploys group‑based Role‑Based Access Control (RBAC) for administrators. Deploys group‑based Role‑Based Access Control (RBAC) for administrators. Source: llm_adapter@2026-05-24 Confidence: high	—

Full changelog

Full Changelog: https://github.com/spupuz/VibeNVR/compare/v1.28.6...v1.28.7

🚀 Release v1.28.7

📝 Summary

This release introduces highly requested granular storage controls, tightens our Role-Based Access Control (RBAC), and hardens the system's security posture. Users can now define precise, custom retention periods per-camera with surgical dashboard estimates. Additionally, administrative capabilities have been expanded with group-based RBAC and deep log redaction guarantees zero trace of sensitive tokens.

🛠️ Key Improvements

🚀 Storage Engine: Introduced support for Custom Days retention policies at the per-camera level. The Storage Dashboard now calculates and displays exact Capacity and Required Storage estimates even for micro-burn rates (threshold lowered to 0.01 GB).
🛡️ Security & Privacy: Implemented robust, system-wide log redaction to instantly mask tokens and passwords. Hardened the PyAV engine pre-flight checks and significantly fortified SSRF/Path Traversal protections.
👥 Access Control: Deployed comprehensive Group-Based RBAC. Administrators can now edit existing user capabilities dynamically while ensuring Viewer roles remain strictly isolated from sensitive actions.