{"id":"CVE-2026-33125","aliases":["GHSA-vg28-83rp-8xx4","PYSEC-2026-2483"],"url":"https://o3.security/vulnerability/CVE-2026-33125","summary":"Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts","details":"### Summary\nUsers with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.\n\n### Details\nEndpoint `DELETE /api/users/admin` is enable to anonymous user.\n\n<img width=\"436\" height=\"100\" alt=\"obraz\" src=\"https://github.com/user-attachments/assets/817f9c47-7bd9-4247-a2f1-0f40778ab229\" />\n\n### PoC\nI deleted admin user on `demo.frigate.video`:\n\n<img width=\"1091\" height=\"222\" alt=\"obraz\" src=\"https://github.com/user-attachments/assets/34f50a13-3bb7-4aa8-99fa-bd815b3dc915\" />\n\n\n### Impact\nIt this leads to denial of service and affects data integrity.\n\n### Recommended Fixes\nRestrict access to the endpoint to authenticated admin users only:\nAdd `dependencies=[Depends(require_role([\"admin\"]))])` to this endpoint.","published":"2026-03-20T09:22:39.139Z","modified":"2026-08-12T03:51:38.424340443Z","cvss":{"score":7.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"},"epss":{"score":0.00243,"percentile":0.15183,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"frigate","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33125.json"},{"type":"ADVISORY","url":"https://github.com/blakeblackshear/frigate/security/advisories/GHSA-vg28-83rp-8xx4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33125"},{"type":"PACKAGE","url":"https://github.com/blakeblackshear/frigate"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:38.424340443Z"}}