PT-2026-26098 · Frigate · Frigate

Czerlun

·

Publicado

2026-03-18

·

Atualizado

2026-03-22

·

CVE-2026-33125

CVSS v3.1

8.1

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Name of the Vulnerable Software and Affected Versions Frigate versions 0.16.2 and below
Description Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Users with the viewer role can delete admin and low-privileged user accounts, potentially leading to denial of service and affecting data integrity. The API endpoint DELETE /api/users/admin is accessible to unauthorized users. A proof of concept demonstrates the deletion of an admin user on demo.frigate.video.
Recommendations Versions prior to 0.16.3 should be updated. Restrict access to the DELETE /api/users/admin endpoint to authenticated admin users only by adding dependencies=[Depends(require role(["admin"]))]) to the endpoint.

Exploit

Correção

Improper Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2026-33125
GHSA-VG28-83RP-8XX4

Produtos afetados

Frigate