Frigate, a network video recorder, allows a low‑privilege authenticated user to view snapshots from cameras they are not authorized to access. Two authorization lapses enable this: the timeline API returns entries for all cameras, and the snapshot endpoint does not validate that the requested event belongs to the caller’s camera set. As a result, an attacker can enumerate event IDs from unauthorized cameras and fetch clean snapshot images.

The vulnerability exists in Frigate version 0.17.0 released by blakeblackshear. Version 0.17.1 or later resolves the issue. Only installations running 0.17.0 are affected.

The vulnerability carries a CVSS score of 6.5, indicating moderate risk, and an EPSS score below 1%, suggesting low likelihood of widespread exploitation. It is not listed in the CISA KEV catalog. An attacker must first authenticate with a standard user account but can then exploit the exposed endpoints to retrieve sensitive camera media. While the attack does not grant code execution or system compromise, it allows unauthorized viewing of recorded footage, which may contain confidential or sensitive information.