GHSA-vg28-83rp-8xx4

Source

https://github.com/advisories/GHSA-vg28-83rp-8xx4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vg28-83rp-8xx4/GHSA-vg28-83rp-8xx4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vg28-83rp-8xx4

Aliases

Published

2026-03-18T14:25:15Z

Modified

2026-07-13T16:43:24Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVSS Calculator

Summary

Frigte has broken access control viewer user can delete admin and other users account

Details

Summary

Users with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.

Details

Endpoint DELETE /api/users/admin is enable to anonymous user.

PoC

I deleted admin user on demo.frigate.video:

Impact

It this leads to denial of service and affects data integrity.

Recommended Fixes

Restrict access to the endpoint to authenticated admin users only: Add dependencies=[Depends(require_role(["admin"]))]) to this endpoint.

Database specific

{
    "cwe_ids":  [
        "CWE-285"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-18T14:25:15Z",
    "nvd_published_at":  "2026-03-20T10:16:19Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / frigate

Package

Name: frigate; View open source insights on deps.dev
Purl: pkg:pypi/frigate

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.1.0

0.2.0

0.3.0

0.4.0a0

0.4.0a0.post0.dev14

0.4.0

0.5.0a0

0.5.0a0.post0.dev2

0.5.0a0.post0.dev3

0.5.0a0.post0.dev4

0.5.0a0.post0.dev7

0.5.0a0.post0.dev8

0.5.0

0.6.0a0

0.6.0a0.post0.dev2

0.6.0a0.post0.dev3

0.6.0a0.post0.dev4

0.6.0

0.6.1

0.7.0a0

0.7.0a0.post0.dev1

0.7.0a0.post0.dev32

0.7.0a0.post0.dev34

0.7.0a0.post0.dev37

0.7.0a0.post0.dev38

0.7.0

0.8.0a0.post0.dev39

0.8.0a0.post0.dev40

0.8.0a0.post0.dev41

Database specific

last_known_affected_version_range

"< 0.16.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vg28-83rp-8xx4/GHSA-vg28-83rp-8xx4.json"