In breve
- CVE-2026-33125 è una vulnerabilità ALTO (CVSS 8.1) che riguarda frigate, frigate (frigate).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.25%, superiore al 16.1% delle vulnerabilità.
- Correzione: aggiornare a 0.16.3 o successiva.
| Package | Affected versions | Patched versions |
|---|
| frigate PyPI | < 0.16.3all versions
| 0.16.3
|
| frigate | < 0.16.3
| 0.16.3
|
Description
Summary
Users with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.
Details
Endpoint DELETE /api/users/admin is enable to anonymous user.
<img width="436" height="100" alt="obraz" src="https://github.com/user-attachments/assets/817f9c47-7bd9-4247-a2f1-0f40778ab229" />
PoC
I deleted admin user on demo.frigate.video:
<img width="1091" height="222" alt="obraz" src="https://github.com/user-attachments/assets/34f50a13-3bb7-4aa8-99fa-bd815b3dc915" />
Impact
It this leads to denial of service and affects data integrity.
Recommended Fixes
Restrict access to the endpoint to authenticated admin users only:
Add dependencies=[Depends(require_role(["admin"]))]) to this endpoint.
NVD description
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free