CVE-2026-33125

Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts

Published Mar 20, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.

Analysis

Technical impact

A flaw in Frigate versions 0.16.2 and earlier allows any user with the viewer role to delete administrator and other low‑privileged accounts, which removes critical users and can lead to loss of data integrity and a denial of service for legitimate users. This is a classic broken access control vulnerability classified as CWE‑285.

Affected Systems

The affected product is Frigate, a network video recorder developed by blakeblackshear. All releases up to and including 0.16.2 are susceptible; users of 0.16.3 and newer are safe.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.1 and an EPSS rating below 1 %, indicating current exploitation is unlikely but possible. It is not listed in CISA’s KEV catalog. Exploitation requires an authenticated viewer account, so the attack vector is an authenticated, non‑privileged user modifying system state, as inferred from the description.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

blakeblackshear

frigate

affected

Version	Status	Constraints
`< 0.16.3`	affected	—

Configuration 1 [-]

cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Blakeblackshear

Frigate

Version	Status	Scheme	Platform
`[0,0.16.3)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Frigate to version 0.16.3 or later to apply the fix for broken access control.
If an upgrade cannot be performed immediately, revoke or delete any viewer‑role accounts that may be able to delete critical accounts until the patch is applied.
After applying the patch or revoking accounts, verify that administrator and low‑privileged accounts can no longer be removed by users with viewer privileges and monitor logs for unauthorized deletion attempts.

Generated by OpenCVE AI on March 20, 2026 at 21:25 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-vg28-83rp-8xx4	Frigte has broken access control viewer user can delete admin and other users account

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.253% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3
https://github.com/blakeblackshear/frigate/security/advisories/GHSA-vg28-83rp-8xx4

History

Mar 20, 2026 8:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Frigate Frigate frigate
CPEs		cpe:2.3:a:frigate:frigate::::::::
Vendors & Products		Frigate Frigate frigate

Mar 20, 2026 4:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Blakeblackshear Blakeblackshear frigate
Vendors & Products		Blakeblackshear Blakeblackshear frigate

Mar 20, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 20, 2026 9:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.
Title		Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts
Weaknesses		CWE-285
References		https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3 https://github.com/blakeblackshear/frigate/security/advisories/GHSA-vg28-83rp-8xx4
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'}`