PT-2026-26098 · Frigate · Frigate

Czerlun · Published 2026-03-18 · Updated 2026-03-22 · CVE-2026-33125

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frigate versions 0.16.2 and below

Description Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Users with the viewer role can delete admin and low-privileged user accounts, potentially leading to denial of service and affecting data integrity. The API endpoint DELETE /api/users/admin is accessible to unauthorized users. A proof of concept demonstrates the deletion of an admin user on demo.frigate.video.

Recommendations Versions prior to 0.16.3 should be updated. Restrict access to the DELETE /api/users/admin endpoint to authenticated admin users only by adding dependencies=[Depends(require role(["admin"]))]) to the endpoint.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-33125

GHSA-VG28-83RP-8XX4

Affected Products

Frigate

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33125.json · Exploit
• https://github.com/blakeblackshear/frigate/security/advisories/GHSA-vg28-83rp-8xx4 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vg28-83rp-8xx4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33125 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33125 · Security Note
• https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3 · Note
• https://github.com/blakeblackshear/frigate · Note
• https://twitter.com/RedPacketSec/status/2035097388411449807 · Twitter Post
• https://twitter.com/pulsepatchio/status/2035727279742222538 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1rx6vrw/resumen_diario_de_vulnerabilidades_18032026 · Reddit Post
• https://twitter.com/CVEnew/status/2035626996403687540 · Twitter Post