CVE-2026-33125: fallo de gravedad alta en blakeblackshear frigate
Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.3%
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Productos afectados
blakeblackshear · frigateCVEs relacionadas — blakeblackshear frigate
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-25643CRITICALFrigate Affected by Authenticated Remote Command Execution (RCE) and Container EscapeEPSS 3.0%CVE-2023-45672HIGHFrigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py`EPSS 1.6%CVE-2023-45671MEDIUMFrigate reflected XSS through `/<camera_name>` API endpointsEPSS 1.4%CVE-2024-32874MEDIUMIn Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of ServiceEPSS 0.8%CVE-2026-75607HIGHFrigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only OperationsEPSS 0.6%CVE-2023-45670HIGHFrigate cross-site request forgery in `config_save` and `config_set` request handlersEPSS 0.5%