Skip to content
OpenAdvisories
High · 7.1 CVE-2026-33125 EUVD-2026-13665GHSA-vg28-83rp-8xx4PYSEC-2026-2483

Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts

Published Mar 20, 2026 · Updated Mar 20, 2026 · Assigned by GitHub_M

Description

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.

Affected products

VendorProductAffectedFixed
blakeblackshear frigate < 0.16.3 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI frigate all versions — GHSA-vg28-83rp-8xx4
PyPI frigate < 0.16.3 0.16.3 PYSEC-2026-2483

References