Read the docs
TI-2026-52911 Aliases CVE-2026-75607

Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations

Priority HIGH 68CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware authorization to the handler. Any authenticated viewer can send admin-only topics such as restart, notifications/set, and camera detection, recording, snapshot, audio, motion, and enablement settings, causing service restarts or disabling security monitoring functions. Authentication must be enabled and valid viewer credentials are required. This issue is fixed in version 0.17.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00636 50th percentileScored 2026-11-07
Fix Fixed frigate (blakeblackshear): 0.17.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
blakeblackshearfrigatebefore 0.17.20.17.2Patch availableCNA
  • frigate Vendorblakeblackshear Affected before 0.17.2 Fixed in 0.17.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:*——blakeblackshear
  • cpe:2.3:a:frigate:frigate:*:*:*:*:*:*:*:* Versions — — ·blakeblackshear

Remediation

  • Fix · CNA frigate (blakeblackshear) Fixed in 0.17.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-75607
  2. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Other 4

  • TI-2026-20743 Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape CVSS 3.1CRITICAL 9.1
  • TI-2026-39479 Frigate viewer can read logs exposing admin and camera credentials CVSS 3.1HIGH 8.1
  • TI-2026-25557 Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts CVSS 3.1HIGH 8.1
  • TI-2026-52912 Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information CVSS 3.1HIGH 7.7
  • TI-2025-38649 Frigate Vulnerable to Arbitrary File Read via Export Thumbnail "image_path" parameter CVSS 3.1HIGH 7.7
  • TI-2026-25866 Missing authorization in blakeblackshear frigate CVSS 3.1MEDIUM 6.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences