Prior to version 0.17.2, the WebSocket handler in Frigate forwards message topics chosen by the attacker to the dispatcher without verifying the authenticated user’s role. Because the nginx subrequest used for authentication does not pass role information, any authenticated viewer can publish topics that are reserved for administrators, such as restart, notification configuration, and camera system settings. The attacker can cause service restarts, disable motion detection or audio recording, and alter camera enablement, effectively compromising the system’s availability and monitoring capabilities. This flaw is mapped to CWE‑862, indicating an authorization bypass.

The vulnerability affects Frigate, the open‑source network video recorder produced by blakeblackshear. All builds before version 0.17.2 are vulnerable; version 0.17.2 and later contain the fix and therefore are not affected.

The recorded CVSS score of 8.1 points to high risk. EPSS information is not available, and the CVE is not listed in CISA's KEV catalog, suggesting that known exploitation activity has not yet been reported. Attackers must first authenticate to the system to gain WebSocket access; once authenticated, the missing role check allows the attacker to send admin‑only operations, so the threat vector is likely network‑based execution of privileged commands through a WebSocket connection. The absence of additional exploitation prerequisites makes this weakness both straightforward to exploit and capable of disrupting or disabling critical security functions.