The vulnerability allows an authenticated user who is not an administrator to retrieve the entire raw configuration file at /api/config/raw, bypassing the intended restriction that only admin users may view sensitive configuration data. This exposes camera, stream, MQTT, proxy secrets, and any other credentials stored in config.yml, constituting a breach of confidentiality as a broken access control flaw (CWE‑863).

Frigate, a network video recorder by Blake Blackshear, is affected in version 0.17.0. Version 0.17.1 includes a patch that restricts the raw configuration endpoint to administrators only; no other versions are listed as impacted.

With a CVSS score of 6.5, the vulnerability is medium severity and the EPSS score of less than 1% indicates low exploitation probability. It is not listed in CISA’s KEV catalog. Exploitation requires legitimate authentication to the API; a non‑admin user can simply request /api/config/raw and receive the unredacted file, potentially enabling credential compromise and downstream attacks on connected devices.