{"id":"CVE-2026-63287","kind":"vulnerability","aliases":["CVE-2026-63287"],"related":[],"title":"AXIS Camera Station: non-admin users can modify data objects, tampering audit logs","description":"It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper with audit log creation in AXIS Camera Station.","summary":"An authenticated non-admin user could modify certain data objects without the required permissions in AXIS Camera Station. This could be used to tamper with audit log creation.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AXIS Camera Station","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["axis-camera-station","infrastructure","video-surveillance"],"not_affected_if":["admin-only-accounts"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T06:17:10+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","triaged_at":"2026-11-10T06:22:18+00:00","updated_at":"2026-11-10T06:22:18+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T06:22:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"AXIS Camera Station: non-admin users can modify data objects, tampering audit logs","impact":"medium","summary":"An authenticated non-admin user could modify certain data objects without the required permissions in AXIS Camera Station. This could be used to tamper with audit log creation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["axis-camera-station","video-surveillance"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Non-admin user tampers with audit log records","analyst_note":"Find affected and fixed versions of AXIS Camera Station from the Axis security advisory referenced by NVD.","how_to_check":"- unknown","plain_action":"","product_name":"AXIS Camera Station","needs_analyst":true,"not_affected_if":["admin-only-accounts"],"who_is_affected":"Organizations running AXIS Camera Station video management software where non-admin accounts exist. The sources do not state which versions or configurations are affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":4506,"output_tokens":421,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-63287':17A,20A 'admin':6A,36B,69C 'appropri':79C 'audit':13A,58B,88C 'authent':33B,66C 'axi':1A,25B,48B,92C 'axis':21A 'axis-camera-st':24B 'camera':2A,22A,26B,49B,93C 'certain':40B,73C 'could':38B,52B,82C 'creation':60B,90C 'cve':15A,18A 'data':10A,41B,74C 'infrastructur':28B 'log':14A,59B,89C 'modifi':9A,39B,72C 'non':5A,35B,68C 'non-admin':4A,34B,67C 'object':11A,42B,75C 'permiss':46B,80C 'possibl':63C 'requir':45B 'station':3A,23A,27B,50B,94C 'surveil':31B 'tamper':12A,56B,86C 'use':54B,84C 'user':7A,37B,70C 'video':30B 'video-surveil':29B 'without':43B,76C","nicknames":[],"mitigations":[],"who_affected":"Organizations running AXIS Camera Station video management software where non-admin accounts exist. The sources do not state which versions or configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["axiscamerastation","camerastation"],"ptokens":["axis","camera","station"],"labels":["axiscamerastation","infrastructure","medium","vendor","videosurveillance"],"campaign_type":null,"search_a":"'-2026':16A,19A '-63287':17A,20A 'admin':6A 'audit':13A 'axi':1A 'axis':21A 'camera':2A,22A 'cve':15A,18A 'data':10A 'log':14A 'modifi':9A 'non':5A 'non-admin':4A 'object':11A 'station':3A,23A 'tamper':12A 'user':7A","search_b":"'admin':36B 'audit':58B 'authent':33B 'axi':25B,48B 'axis-camera-st':24B 'camera':26B,49B 'certain':40B 'could':38B,52B 'creation':60B 'data':41B 'infrastructur':28B 'log':59B 'modifi':39B 'non':35B 'non-admin':34B 'object':42B 'permiss':46B 'requir':45B 'station':27B,50B 'surveil':31B 'tamper':56B 'use':54B 'user':37B 'video':30B 'video-surveil':29B 'without':43B","search_c":"'admin':69C 'appropri':79C 'audit':88C 'authent':66C 'axi':92C 'camera':93C 'certain':73C 'could':82C 'creation':90C 'data':74C 'log':89C 'modifi':72C 'non':68C 'non-admin':67C 'object':75C 'permiss':80C 'possibl':63C 'station':94C 'tamper':86C 'use':84C 'user':70C 'without':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T06:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"product-security@axis.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63287","severity":null,"published_at":"2026-11-10T06:17:10+00:00","modified_at":"2026-11-10T06:17:10+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","fetched_at":"2026-11-10T06:20:23+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}