Read the docs
TI-2026-25866 Aliases CVE-2026-33470

Missing authorization in blakeblackshear frigate

Priority MEDIUM 62CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, a low-privilege authenticated user restricted to one camera can access snapshots from other cameras. This is possible through a chain of two authorization problems: `/api/timeline` returns timeline entries for cameras outside the caller's allowed camera set, then `/api/events/{event_id}/snapshot-clean.webp` declares `Depends(require_camera_access)` but never actually validates `event.camera` after looking up the event. Together, this allows a restricted user to enumerate event IDs from unauthorized cameras and then fetch clean snapshots for those events. Version 0.17.1 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00317 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
blakeblackshearfrigate= 0.17.0—No fix listedCNA
  • frigate Vendorblakeblackshear Affected = 0.17.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:frigate:frigate:0.17.0:*:*:*:*:*:*:*0.17.0Vulnerableblakeblackshear
  • cpe:2.3:a:frigate:frigate:0.17.0:*:*:*:*:*:*:* Versions 0.17.0 Vulnerable ·blakeblackshear

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33470

References

Exploit 1

  • TI-2026-20743 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape CVSS 3.1CRITICAL 9.1
  • TI-2026-25557 Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts CVSS 3.1HIGH 8.1
  • TI-2026-25865 Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw CVSS 3.1MEDIUM 6.5
  • TI-2026-25558 Frigate has SSRF vulnerability in /ffprobe endpoint CVSS 3.1MEDIUM 5.0
  • TI-2026-25556 Frigate has insecure password change functionality CVSS 4.0HIGH 8.6
  • TI-2023-24471 Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py` CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences