CVE-2026-33125

HIGH

Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts

Title source: cna
STIX 2.1

Description

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.

References (2)

Scores

CVSS v3 7.1
EPSS 0.0005
EPSS Percentile 15.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-285
Status published
Products (3)
blakeblackshear/frigate < 0.16.3
frigate/frigate < 0.16.3
pypi/frigate 0PyPI
Published Mar 20, 2026
Tracked Since Mar 20, 2026