CVE-2026-33125: Frigate Package Allows Viewer Role to Delete Admin Accounts
Summary
CVE-2026-33125: Frigte has broken access control viewer user can delete admin and other users account. Affects frigate versions 0.1.0 – 0.8.0a0.post0.dev41. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Frigate is an open-source software package designed for real-time object detection and monitoring using video feeds. It is widely used in surveillance and security applications due to its ability to integrate with various camera systems and provide intelligent alerts. However, a critical vulnerability has been identified that allows users with a viewer role to delete admin accounts, posing a significant risk to system integrity and availability.
Vulnerability Detail
The vulnerability arises from improper access controls on the DELETE endpoint for user accounts in the Frigate application. Specifically, the endpoint DELETE /api/users/admin is accessible to anonymous users, allowing anyone with the appropriate request to delete admin and other user accounts. This can lead to denial of service and compromise data integrity, as critical administrative functions can be disrupted by unauthorized users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement network-level restrictions to limit access to the API endpoint, ensuring that only trusted IP addresses can make DELETE requests. However, this is not a substitute for applying the recommended fix.
Conclusion
The CVE-2026-33125 vulnerability in the Frigate package poses a serious risk by allowing users with viewer roles to delete admin accounts. It is crucial to implement the recommended fixes and update to the latest version to safeguard against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for frigate →
FAQ
The vulnerability allows unauthorized users to delete admin accounts, leading to potential denial of service and data integrity issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update, implement network-level restrictions as a temporary workaround to limit access to the vulnerable endpoint.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
You can find more information about Frigate on its official GitHub repository or documentation pages.
References
Related vulnerabilities
Recent vulnerabilities recorded for frigate.
