{"id":"PYSEC-2026-2483","summary":"Frigte has broken access control viewer user can delete admin and other users account","details":"### Summary\nUsers with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.\n\n### Details\nEndpoint `DELETE /api/users/admin` is enable to anonymous user.\n\n\u003cimg width=\"436\" height=\"100\" alt=\"obraz\" src=\"https://github.com/user-attachments/assets/817f9c47-7bd9-4247-a2f1-0f40778ab229\" /\u003e\n\n### PoC\nI deleted admin user on `demo.frigate.video`:\n\n\u003cimg width=\"1091\" height=\"222\" alt=\"obraz\" src=\"https://github.com/user-attachments/assets/34f50a13-3bb7-4aa8-99fa-bd815b3dc915\" /\u003e\n\n\n### Impact\nIt this leads to denial of service and affects data integrity.\n\n### Recommended Fixes\nRestrict access to the endpoint to authenticated admin users only:\nAdd `dependencies=[Depends(require_role([\"admin\"]))])` to this endpoint.","aliases":["CVE-2026-33125","GHSA-vg28-83rp-8xx4"],"modified":"2026-07-13T16:32:37.155510609Z","published":"2026-07-13T14:36:43.339990Z","references":[{"type":"WEB","url":"https://github.com/blakeblackshear/frigate/security/advisories/GHSA-vg28-83rp-8xx4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33125"},{"type":"PACKAGE","url":"https://github.com/blakeblackshear/frigate"},{"type":"WEB","url":"https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3"},{"type":"PACKAGE","url":"https://pypi.org/project/frigate"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vg28-83rp-8xx4"}],"affected":[{"package":{"name":"frigate","ecosystem":"PyPI","purl":"pkg:pypi/frigate"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.3"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.4.0","0.4.0a0","0.4.0a0.post0.dev14","0.5.0","0.5.0a0","0.5.0a0.post0.dev2","0.5.0a0.post0.dev3","0.5.0a0.post0.dev4","0.5.0a0.post0.dev7","0.5.0a0.post0.dev8","0.6.0","0.6.0a0","0.6.0a0.post0.dev2","0.6.0a0.post0.dev3","0.6.0a0.post0.dev4","0.6.1","0.7.0","0.7.0a0","0.7.0a0.post0.dev1","0.7.0a0.post0.dev32","0.7.0a0.post0.dev34","0.7.0a0.post0.dev37","0.7.0a0.post0.dev38","0.8.0a0.post0.dev39","0.8.0a0.post0.dev40","0.8.0a0.post0.dev41"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/frigate/PYSEC-2026-2483.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"}]}