https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T21:12:02.801930+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33125 CVE-2026-33125 — Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts 2026-10-05T21:12:02.803553+00:00

Affected: blakeblackshear frigate

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.

 https://cve.radiocsirt.org/vuln/ghsa-vg28-83rp-8xx4 GHSA-vg28-83rp-8xx4 — Frigte has broken access control viewer user can delete admin and other users account 2026-10-05T21:12:02.803606+00:00

Affected: PyPI: frigate

### Summary Users with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.

### Details Endpoint `DELETE /api/users/admin` is enable to anonymous user.

<img width="436" height="100" alt="obraz" src="https://github.com/user-attachments/assets/817f9c47-7bd9-4247-a2f1-0f40778ab229" />

### PoC I deleted admin user on `demo.frigate.video`:

<img width="1091" height="222" alt="obraz" src="https://github.com/user-attachments/assets/34f50a13-3bb7-4aa8-99fa-bd815b3dc915" />

### Impact It this leads to denial of service and affects data integrity.

### Recommended Fixes Restrict access to the endpoint to authenticated admin users only: Add `dependencies=[Depends(require_role(["admin"]))])` to this endpoint.