CVE-2026-33125 Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts

What is CVE-2026-33125?

CVE-2026-33125 is a high-severity missing authorization vulnerability in blakeblackshear frigate, published on 20 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.

Weakness: CWE-285

Which versions are affected by CVE-2026-33125?

3 open source packages ship an affected version, including frigate. It affects 1 product.

Products include Frigate Frigate.

How do I fix CVE-2026-33125?

Upgrade frigate to 0.16.3 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-33125 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33125 exists.

Other vulnerabilities in blakeblackshear frigate

• CVE-2026-25643 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape Critical 9.1
• CVE-2026-33124 Frigate has insecure password change functionality High 8.6
• CVE-2023-45670 Frigate cross-site request forgery in `config_save` and `config_set` request handlers High 7.5
• CVE-2023-45672 Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py` High 7.5
• CVE-2026-33469 Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vg28-83rp-8xx4, PYSEC-2026-2483.