{"id":"CVE-2026-33125","aliases":["EUVD-2026-13665","GHSA-vg28-83rp-8xx4","PYSEC-2026-2483"],"status":"published","title":"Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts","description":"Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00253,"percentile":0.16894,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285"],"published":"2026-03-18T14:25:15Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"PyPI","package":"frigate","fixed_in":["0.16.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"frigate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"frigate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.4.0","0.4.0a0","0.4.0a0.post0.dev14","0.5.0","0.5.0a0","0.5.0a0.post0.dev2","0.5.0a0.post0.dev3","0.5.0a0.post0.dev4","0.5.0a0.post0.dev7","0.5.0a0.post0.dev8","0.6.0","0.6.0a0","0.6.0a0.post0.dev2","0.6.0a0.post0.dev3","0.6.0a0.post0.dev4","0.6.1","0.7.0","0.7.0a0","0.7.0a0.post0.dev1","0.7.0a0.post0.dev32","0.7.0a0.post0.dev34","0.7.0a0.post0.dev37","0.7.0a0.post0.dev38","0.8.0a0.post0.dev39","0.8.0a0.post0.dev40","0.8.0a0.post0.dev41"]},{"source":"osv","ecosystem":"PyPI","package":"frigate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.3"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.4.0","0.4.0a0","0.4.0a0.post0.dev14","0.5.0","0.5.0a0","0.5.0a0.post0.dev2","0.5.0a0.post0.dev3","0.5.0a0.post0.dev4","0.5.0a0.post0.dev7","0.5.0a0.post0.dev8","0.6.0","0.6.0a0","0.6.0a0.post0.dev2","0.6.0a0.post0.dev3","0.6.0a0.post0.dev4","0.6.1","0.7.0","0.7.0a0","0.7.0a0.post0.dev1","0.7.0a0.post0.dev32","0.7.0a0.post0.dev34","0.7.0a0.post0.dev37","0.7.0a0.post0.dev38","0.8.0a0.post0.dev39","0.8.0a0.post0.dev40","0.8.0a0.post0.dev41"]}],"products":[{"vendor":"blakeblackshear","product":"frigate"},{"vendor":"frigate","product":"frigate"}],"references":[{"url":"https://github.com/blakeblackshear/frigate/security/advisories/GHSA-vg28-83rp-8xx4","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33125","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vg28-83rp-8xx4","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33125.json","tags":["advisory"]},{"url":"https://github.com/blakeblackshear/frigate","tags":["package"]},{"url":"https://pypi.org/project/frigate","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-33125","title":"Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts","description":"Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.","status":"published","published":"2026-03-20T09:22:39.139Z","modified":"2026-03-20T15:39:11.11Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:20:08.009733Z"}],"euvd":[{"id":"EUVD-2026-13665","description":"Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.","status":"published","published":"2026-03-20T09:22:39Z","modified":"2026-03-20T15:39:11Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T19:25:32.430758Z"}],"ghsa":[{"id":"GHSA-vg28-83rp-8xx4","title":"Frigte has broken access control viewer user can delete admin and other users account","description":"### Summary\nUsers with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.\n\n### Details\nEndpoint `DELETE /api/users/admin` is enable to anonymous user.\n\n\u003cimg width=\"436\" height=\"100\" alt=\"obraz\" src=\"https://github.com/user-attachments/assets/817f9c47-7bd9-4247-a2f1-0f40778ab229\" /\u003e\n\n### PoC\nI deleted admin user on `demo.frigate.video`:\n\n\u003cimg width=\"1091\" height=\"222\" alt=\"obraz\" src=\"https://github.com/user-attachments/assets/34f50a13-3bb7-4aa8-99fa-bd815b3dc915\" /\u003e\n\n\n### Impact\nIt this leads to denial of service and affects data integrity.\n\n### Recommended Fixes\nRestrict access to the endpoint to authenticated admin users only:\nAdd `dependencies=[Depends(require_role([\"admin\"]))])` to this endpoint.","status":"published","published":"2026-03-18T14:25:15Z","modified":"2026-03-20T21:27:22Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:39:39.567266Z"}],"nvd":[{"id":"CVE-2026-33125","description":"Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.","status":"published","published":"2026-03-20T10:16:19.013Z","modified":"2026-06-17T10:36:59.44Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:12:10.126802Z"}],"osv":[{"id":"CVE-2026-33125","title":"Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts","description":"Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.","status":"published","published":"2026-03-20T09:22:39.139Z","modified":"2026-10-28T02:30:59.908220561Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"GHSA-vg28-83rp-8xx4","title":"Frigte has broken access control viewer user can delete admin and other users account","description":"### Summary\nUsers with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.\n\n### Details\nEndpoint `DELETE /api/users/admin` is enable to anonymous user.\n\n\u003cimg width=\"436\" height=\"100\" alt=\"obraz\" src=\"https://github.com/user-attachments/assets/817f9c47-7bd9-4247-a2f1-0f40778ab229\" /\u003e\n\n### PoC\nI deleted admin user on `demo.frigate.video`:\n\n\u003cimg width=\"1091\" height=\"222\" alt=\"obraz\" src=\"https://github.com/user-attachments/assets/34f50a13-3bb7-4aa8-99fa-bd815b3dc915\" /\u003e\n\n\n### Impact\nIt this leads to denial of service and affects data integrity.\n\n### Recommended Fixes\nRestrict access to the endpoint to authenticated admin users only:\nAdd `dependencies=[Depends(require_role([\"admin\"]))])` to this endpoint.","status":"published","published":"2026-03-18T14:25:15Z","modified":"2026-07-13T16:43:24.148359358Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:57.348035Z"},{"id":"PYSEC-2026-2483","title":"Frigte has broken access control viewer user can delete admin and other users account","description":"### Summary\nUsers with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.\n\n### Details\nEndpoint `DELETE /api/users/admin` is enable to anonymous user.\n\n\u003cimg width=\"436\" height=\"100\" alt=\"obraz\" src=\"https://github.com/user-attachments/assets/817f9c47-7bd9-4247-a2f1-0f40778ab229\" /\u003e\n\n### PoC\nI deleted admin user on `demo.frigate.video`:\n\n\u003cimg width=\"1091\" height=\"222\" alt=\"obraz\" src=\"https://github.com/user-attachments/assets/34f50a13-3bb7-4aa8-99fa-bd815b3dc915\" /\u003e\n\n\n### Impact\nIt this leads to denial of service and affects data integrity.\n\n### Recommended Fixes\nRestrict access to the endpoint to authenticated admin users only:\nAdd `dependencies=[Depends(require_role([\"admin\"]))])` to this endpoint.","status":"published","published":"2026-07-13T14:36:43.33999Z","modified":"2026-07-13T16:32:37.155510609Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"}]}}