---
id: CVE-2026-33125
aliases:
  - GHSA-vg28-83rp-8xx4
  - PYSEC-2026-2483
title: >-
  Frigte has broken access control viewer user can delete admin and other users
  account
summary: >-
  Frigte has broken access control viewer user can delete admin and other users
  account
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'
vendor: frigate
product: frigate
ecosystem: pip
affected:
  - frigate
published: '2026-03-18'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vg28-83rp-8xx4'
references:
  - url: >-
      https://github.com/blakeblackshear/frigate/security/advisories/GHSA-vg28-83rp-8xx4
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33125'
  - url: 'https://github.com/blakeblackshear/frigate'
  - url: 'https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3'
tags:
  - osv
  - pip
epss: 0.00369
epssPercentile: 0.28181
ingestedAt: '2026-07-13T18:58:03.528Z'
---

## Overview

### Summary
Users with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.

### Details
Endpoint `DELETE /api/users/admin` is enable to anonymous user.

<img width="436" height="100" alt="obraz" src="https://github.com/user-attachments/assets/817f9c47-7bd9-4247-a2f1-0f40778ab229" />

### PoC
I deleted admin user on `demo.frigate.video`:

<img width="1091" height="222" alt="obraz" src="https://github.com/user-attachments/assets/34f50a13-3bb7-4aa8-99fa-bd815b3dc915" />


### Impact
It this leads to denial of service and affects data integrity.

### Recommended Fixes
Restrict access to the endpoint to authenticated admin users only:
Add `dependencies=[Depends(require_role(["admin"]))])` to this endpoint.

## Affected packages

- `frigate`

## Remediation

Refer to the advisory for the patched release.