PYSEC-2026-2483
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/frigate/PYSEC-2026-2483.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2483
- Aliases
- Published
- 2026-07-13T14:36:43Z
- Modified
- 2026-07-13T16:32:37Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVSS Calculator
- Summary
- Frigte has broken access control viewer user can delete admin and other users account
- Details
-
Summary
Users with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.
Details
Endpoint
DELETE /api/users/adminis enable to anonymous user.PoC
I deleted admin user on
demo.frigate.video:Impact
It this leads to denial of service and affects data integrity.
Recommended Fixes
Restrict access to the endpoint to authenticated admin users only: Add
dependencies=[Depends(require_role(["admin"]))])to this endpoint. - References
-
- https://github.com/blakeblackshear/frigate/security/advisories/GHSA-vg28-83rp-8xx4
- https://nvd.nist.gov/vuln/detail/CVE-2026-33125
- https://github.com/blakeblackshear/frigate
- https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3
- https://pypi.org/project/frigate
- https://github.com/advisories/GHSA-vg28-83rp-8xx4
Affected packages
PyPI / frigate
Package
- Name
- frigate
- View open source insights on deps.dev
- Purl
- pkg:pypi/frigate
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed0.16.3
Affected versions
0.*
0.1.0
0.2.0
0.3.0
0.4.0a0
0.4.0a0.post0.dev14
0.4.0
0.5.0a0
0.5.0a0.post0.dev2
0.5.0a0.post0.dev3
0.5.0a0.post0.dev4
0.5.0a0.post0.dev7
0.5.0a0.post0.dev8
0.5.0
0.6.0a0
0.6.0a0.post0.dev2
0.6.0a0.post0.dev3
0.6.0a0.post0.dev4
0.6.0
0.6.1
0.7.0a0
0.7.0a0.post0.dev1
0.7.0a0.post0.dev32
0.7.0a0.post0.dev34
0.7.0a0.post0.dev37
0.7.0a0.post0.dev38
0.7.0
0.8.0a0.post0.dev39
0.8.0a0.post0.dev40
0.8.0a0.post0.dev41