PT-2026-28485 · Frigate · Frigate

Bg0D-Glitch · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-33470

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Frigate version 0.17.0

Description Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. A low-privilege authenticated user restricted to one camera can access snapshots from other cameras. This is possible due to authorization problems in two API endpoints: /api/timeline returns timeline entries for cameras outside the caller's allowed camera set, and /api/events/{event id}/snapshot-clean.webp does not validate event.camera after looking up the event, despite declaring Depends(require camera access). This allows a restricted user to enumerate event IDs from unauthorized cameras and then fetch clean snapshots for those events using the event id variable.

Recommendations Update to version 0.17.1 or later.

Exploit

Fix

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2026-33470

GHSA-M2MG-PJ9P-2R7G

Affected Products

Frigate

References · 6

• 🔥 https://github.com/blakeblackshear/frigate/security/advisories/GHSA-m2mg-pj9p-2r7g · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33470.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-33470 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33470 · Security Note
• https://twitter.com/infoflowcloud/status/2037281383417078167 · Twitter Post
• https://twitter.com/CVEnew/status/2037280611430523222 · Twitter Post