CVE-2026-33125: 
Python vulnerability analysis and mitigation

CVE-2026-33125 is a broken access control vulnerability in Frigate, an open-source network video recorder (NVR) with real-time local object detection for IP cameras. Users assigned the viewer role can delete admin and other user accounts due to missing authorization checks on the DELETE /api/users/admin endpoint. All versions up to and including 0.16.2 are affected; the issue was patched in version 0.16.3. The vulnerability was originally reported by researcher czerlun and published to the GitHub Advisory Database on December 6, 2025, with NVD publication on March 20, 2026. It carries a CVSS v3.1 base score of 8.1 (High) per Feedly threat intelligence, and 7.1 (High) per the GitHub Advisory (GitHub Advisory, Frigate Advisory).

The root cause is CWE-285 (Improper Authorization): the DELETE /api/users/{username} API endpoint in Frigate lacks proper role-based access control enforcement, allowing any authenticated user — including those with the low-privileged viewer role — to issue account deletion requests that should be restricted to administrators. The attack vector is network-based with low attack complexity, requiring only low-level authenticated access (a valid viewer account) and no user interaction. The recommended fix is to add dependencies=[Depends(require_role(["admin"]))] to the affected endpoint, restricting it to admin-role users only (GitHub Advisory, Frigate Advisory).

Successful exploitation allows any authenticated viewer-role user to delete admin and other user accounts on the Frigate instance, resulting in denial of service (loss of access to the NVR system) and data integrity impact (permanent removal of user accounts). There is no confidentiality impact, as the vulnerability does not expose sensitive data. In environments where Frigate manages security camera feeds, loss of admin access could disrupt surveillance operations and prevent legitimate administrators from managing the system (GitHub Advisory, Frigate Advisory).

A proof-of-concept exploit is publicly documented in the GitHub security advisory, demonstrating that the DELETE /api/users/admin endpoint was successfully used to delete the admin user on the official Frigate demo instance (demo.frigate.video) (Frigate Advisory). The exploit requires only a valid viewer-role account and a single HTTP DELETE request, making it trivially reproducible. The EPSS score is approximately 0.036–0.058%, indicating a low but non-negligible probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Obtain viewer credentials: Acquire a valid Frigate account with the viewer role — this may be through social engineering, credential reuse, or a legitimately provisioned low-privilege account.
2. Authenticate to Frigate: Log in to the target Frigate instance via the web UI or API to obtain a valid session token or authentication cookie.
3. Identify target usernames: Browse the Frigate user management interface or enumerate usernames via API calls to identify admin and other user accounts to target.
4. Send DELETE request: Issue an HTTP DELETE request to the unprotected endpoint, e.g.:

   DELETE /api/users/admin HTTP/1.1
   Host: <target-frigate-instance>
   Cookie: <viewer-session-cookie>

5. Achieve denial of service: The admin account is deleted without authorization checks, locking out legitimate administrators and disrupting NVR management (Frigate Advisory, GitHub Advisory).

• Network: Unexpected HTTP DELETE requests to /api/users/<username> endpoints originating from viewer-role sessions; DELETE requests to user management API endpoints from IP addresses not associated with administrative activity.
• Logs: Frigate application logs showing successful user account deletions performed by non-admin (viewer-role) accounts; log entries for DELETE /api/users/admin or DELETE /api/users/<username> with HTTP 200 responses from viewer sessions.
• Application State: Sudden disappearance of admin or user accounts from the Frigate user management interface; administrators unable to log in after previously functioning credentials stop working.

Upgrade Frigate to version 0.16.3 or later, which addresses this vulnerability by enforcing admin-only access on the user deletion endpoint (Frigate Release). As a temporary workaround until patching is possible, restrict viewer role assignments to only fully trusted users and implement network-level access controls (e.g., firewall rules, VPN requirements) to limit who can authenticate to the Frigate instance. Additionally, monitor API logs for unexpected DELETE requests to /api/users/ endpoints from non-admin sessions (GitHub Advisory).

The vulnerability received automated coverage from security aggregators including RedPacket Security (via Twitter/X and Mastodon) and was indexed by multiple vulnerability tracking platforms shortly after NVD publication in March 2026 (Feedly). The Frigate project maintainers responded promptly, releasing version 0.16.3 on the same day the advisory was originally published (December 6, 2025), demonstrating a rapid patch turnaround (Frigate Release). Community reaction on the Frigate GitHub repository was generally positive regarding the quick fix, with 29 users reacting to the release.