GitHub Advisoryadvisory · PyPI

GHSA-vg28-83rp-8xx4 Frigte has broken access control viewer user can delete admin and other users account

HIGH Published 2026-03-18 Modified 2026-03-20 Official page ↗
Aliases
CVE-2026-33125
Ecosystem
PyPI
Packages
frigate
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Weaknesses
CWE-285
Reviewed
2026-03-18

Affected packages

• PyPI frigate: < 0.16.3 (no fix yet)

Description

Summary Users with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity. Details Endpoint `DELETE /api/users/admin` is enable to anonymous user. PoC I deleted admin user on `demo.frigate.video`: Impact It this leads to denial of service and affects data integrity. Recommended Fixes Restrict access to the endpoint to authenticated admin users only: Add `dependencies=[Depends(require_role(["admin"]))])` to this endpoint.

Related

Alias · CVE (1)

  • CVE-2026-33125 Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References