CVE-2026-33125High· 7.1▾ TwilightFrigte has broken access control viewer user can delete admin and other users account
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
Users with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.
Endpoint DELETE /api/users/admin is enable to anonymous user.
I deleted admin user on demo.frigate.video:
It this leads to denial of service and affects data integrity.
Restrict access to the endpoint to authenticated admin users only:
Add dependencies=[Depends(require_role(["admin"]))]) to this endpoint.
frigateRefer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.