https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 21:11:59 +0000 https://cve.radiocsirt.org/vuln/cve-2026-33125 <p><strong>Affected:</strong> blakeblackshear frigate</p> <p>Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.</p> <p><strong>Affected:</strong> blakeblackshear frigate</p> <p>Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.</p> https://cve.radiocsirt.org/vuln/cve-2026-33125 https://cve.radiocsirt.org/vuln/ghsa-vg28-83rp-8xx4 <p><strong>Affected:</strong> PyPI: frigate</p> <p>### Summary Users with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.</p> <p>### Details Endpoint `DELETE /api/users/admin` is enable to anonymous user.</p> <p>&lt;img width=&#34;436&#34; height=&#34;100&#34; alt=&#34;obraz&#34; src=&#34;https://github.com/user-attachments/assets/817f9c47-7bd9-4247-a2f1-0f40778ab229&#34; /&gt;</p> <p>### PoC I deleted admin user on `demo.frigate.video`:</p> <p>&lt;img width=&#34;1091&#34; height=&#34;222&#34; alt=&#34;obraz&#34; src=&#34;https://github.com/user-attachments/assets/34f50a13-3bb7-4aa8-99fa-bd815b3dc915&#34; /&gt;</p> <p>### Impact It this leads to denial of service and affects data integrity.</p> <p>### Recommended Fixes Restrict access to the endpoint to authenticated admin users only: Add `dependencies=[Depends(require_role([&#34;admin&#34;]))])` to this endpoint.</p> <p><strong>Affected:</strong> PyPI: frigate</p> <p>### Summary Users with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.</p> <p>### Details Endpoint `DELETE /api/users/admin` is enable to anonymous user.</p> <p>&lt;img width=&#34;436&#34; height=&#34;100&#34; alt=&#34;obraz&#34; src=&#34;https://github.com/user-attachments/assets/817f9c47-7bd9-4247-a2f1-0f40778ab229&#34; /&gt;</p> <p>### PoC I deleted admin user on `demo.frigate.video`:</p> <p>&lt;img width=&#34;1091&#34; height=&#34;222&#34; alt=&#34;obraz&#34; src=&#34;https://github.com/user-attachments/assets/34f50a13-3bb7-4aa8-99fa-bd815b3dc915&#34; /&gt;</p> <p>### Impact It this leads to denial of service and affects data integrity.</p> <p>### Recommended Fixes Restrict access to the endpoint to authenticated admin users only: Add `dependencies=[Depends(require_role([&#34;admin&#34;]))])` to this endpoint.</p> https://cve.radiocsirt.org/vuln/ghsa-vg28-83rp-8xx4