7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33125

CVE-2026-33125: Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33125

CVE-2026-33125:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
frigate	pip	< 0.16.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description indicates a broken access control issue where users with lower privileges can delete any user account. The recommended fix was to add role-based access control to the user deletion endpoint. Based on the provided information, the patched version for the 'frigate' pip package is 0.16.3, and a vulnerable version is 0.16.2. By comparing the git tags for v0.16.2 and v0.16.3 in the blakeblackshear/frigate repository, I identified a set of commits. Among them, commit 592c245dcd25919e7d39bdae2462847c6323850f with the message "require admin role to delete users" directly addresses the vulnerability. Analyzing the diff of this commit reveals changes in frigate/api/auth.py. The delete_user function, which handles user deletion, was modified to include a dependency Depends(require_role(["admin"])). This confirms that prior to this change, the function lacked proper authorization, making it the vulnerable function.

Vulnerable functions

delete_user

frigate/api/auth.py

The function `delete_user` in `frigate/api/auth.py` was exposed via the DELETE endpoint `/api/users/{username}` without any authorization checks. This allowed any authenticated user, regardless of their role, to delete any other user, including administrators, leading to a denial of service and affecting data integrity. The patch added an authorization check to ensure only users with the 'admin' role can perform this action.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.