id: PYSEC-2026-2483
published: "2026-07-13T14:36:43.339990Z"
modified: "2026-07-13T16:04:05.905030Z"
aliases:
- CVE-2026-33125
- GHSA-vg28-83rp-8xx4
summary: Frigte has broken access control viewer user can delete admin and other users account
details: "### Summary\nUsers with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.\n\n### Details\nEndpoint `DELETE /api/users/admin` is enable to anonymous user.\n\n<img width=\"436\" height=\"100\" alt=\"obraz\" src=\"https://github.com/user-attachments/assets/817f9c47-7bd9-4247-a2f1-0f40778ab229\" />\n\n### PoC\nI deleted admin user on `demo.frigate.video`:\n\n<img width=\"1091\" height=\"222\" alt=\"obraz\" src=\"https://github.com/user-attachments/assets/34f50a13-3bb7-4aa8-99fa-bd815b3dc915\" />\n\n\n### Impact\nIt this leads to denial of service and affects data integrity.\n\n### Recommended Fixes\nRestrict access to the endpoint to authenticated admin users only:\nAdd `dependencies=[Depends(require_role([\"admin\"]))])` to this endpoint."
affected:
- package:
    name: frigate
    ecosystem: PyPI
    purl: pkg:pypi/frigate
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.16.3
  versions:
  - 0.1.0
  - 0.2.0
  - 0.3.0
  - 0.4.0
  - 0.4.0a0
  - 0.4.0a0.post0.dev14
  - 0.5.0
  - 0.5.0a0
  - 0.5.0a0.post0.dev2
  - 0.5.0a0.post0.dev3
  - 0.5.0a0.post0.dev4
  - 0.5.0a0.post0.dev7
  - 0.5.0a0.post0.dev8
  - 0.6.0
  - 0.6.0a0
  - 0.6.0a0.post0.dev2
  - 0.6.0a0.post0.dev3
  - 0.6.0a0.post0.dev4
  - 0.6.1
  - 0.7.0
  - 0.7.0a0
  - 0.7.0a0.post0.dev1
  - 0.7.0a0.post0.dev32
  - 0.7.0a0.post0.dev34
  - 0.7.0a0.post0.dev37
  - 0.7.0a0.post0.dev38
  - 0.8.0a0.post0.dev39
  - 0.8.0a0.post0.dev40
  - 0.8.0a0.post0.dev41
references:
- type: WEB
  url: https://github.com/blakeblackshear/frigate/security/advisories/GHSA-vg28-83rp-8xx4
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-33125
- type: PACKAGE
  url: https://github.com/blakeblackshear/frigate
- type: WEB
  url: https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3
- type: PACKAGE
  url: https://pypi.org/project/frigate
- type: ADVISORY
  url: https://github.com/advisories/GHSA-vg28-83rp-8xx4
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H