CVE-2026-33125
CVE-2026-33125 · Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.
CVSS 7.1 · High · EPSS 0.2% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
frigate
- Versions
- < 0.16.3: Affected
No fix published
frigate PyPI
- Versions
- 0.1.0
- 0.2.0
- 0.3.0
- 0.4.0
- 0.4.0a0
- 0.4.0a0.post0.dev14
- 0.5.0
- 0.5.0a0
- 0.5.0a0.post0.dev2
- 0.5.0a0.post0.dev3
- 0.5.0a0.post0.dev4
- 0.5.0a0.post0.dev7
- 0.5.0a0.post0.dev8
- 0.6.0
- 0.6.0a0
- 0.6.0a0.post0.dev2
- 0.6.0a0.post0.dev3
- 0.6.0a0.post0.dev4
- 0.6.1
- 0.7.0
- 0.7.0a0
- 0.7.0a0.post0.dev1
- 0.7.0a0.post0.dev32
- 0.7.0a0.post0.dev34
- 0.7.0a0.post0.dev37
- 0.7.0a0.post0.dev38
- 0.8.0a0.post0.dev39
- 0.8.0a0.post0.dev40
- 0.8.0a0.post0.dev41
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
frigate PyPI
- Versions
- 0.1.0
- 0.2.0
- 0.3.0
- 0.4.0
- 0.4.0a0
- 0.4.0a0.post0.dev14
- 0.5.0
- 0.5.0a0
- 0.5.0a0.post0.dev2
- 0.5.0a0.post0.dev3
- 0.5.0a0.post0.dev4
- 0.5.0a0.post0.dev7
- 0.5.0a0.post0.dev8
- 0.6.0
- 0.6.0a0
- 0.6.0a0.post0.dev2
- 0.6.0a0.post0.dev3
- 0.6.0a0.post0.dev4
- 0.6.1
- 0.7.0
- 0.7.0a0
- 0.7.0a0.post0.dev1
- 0.7.0a0.post0.dev32
- 0.7.0a0.post0.dev34
- 0.7.0a0.post0.dev37
- 0.7.0a0.post0.dev38
- 0.8.0a0.post0.dev39
- 0.8.0a0.post0.dev40
- 0.8.0a0.post0.dev41
- Affected ranges
- ECOSYSTEM: < 0.16.3
Update to 0.16.3