CVE-2026-33125Disclosure(frigate / frigate)

LOWCVSS 8.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch frigate frigate systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.

frigate CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/blakeblackshear/frigate/security/advisories/GHSA-vg28-83rp-8xx4

Other references

https://github.com/blakeblackshear/frigate/releases/tag/v0.16.3

Weakness type (CWE)

CWE-285

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

frigate

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-03-20); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

frigate

Products

frigate

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-20	2	Disclosure1General1
2026-03-22	2	Disclosure2

Full discourse4 posts

PulsePatch.io@pulsepatchio201d
Disclosure
A critical access control flaw (CVE-2026-33125) in `Frigte` allows viewer users to delete admin & other accounts. Monitor vendor for patches. #Frigte #AccessControl #Infosec https://www.pulsepatch.io/posts/cve-2026-33125-frigte-access-control-vulnerability
Post summary
The tweet announces a critical access control vulnerability in Frigte that lets viewer users delete admin accounts and advises users to monitor the vendor for patches.
0000025
2 followersView on X
CVE@CVEnew201d
Disclosure
CVE-2026-33125 Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete adm… https://www.cve.org/CVERecord?id=CVE-2026-33125
Post summary
The text announces a new vulnerability in Frigate’s NVR, noting that viewer‑role users can delete administrative data in older releases, but it contains no PoC, exploit details, patch info, or evidence of ongoing exploitation.
00000106
56.8K followersView on X
RedPacket Security@RedPacketSec202d
General
CVE Alert: CVE-2026-33125 - blakeblackshear - frigate - https://www.redpacketsecurity.com/cve-alert-cve-2026-33125-blakeblackshear-frigate/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-33125 #blakeblackshear #frigate
Post summary
The content merely announces a CVE reference via a URL without providing details on the vulnerability, PoC, exploits, or mitigations.
0000075
3.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds203d
Disclosure
CVE-2026-33125 Frigate NVR Privilege Escalation Vulnerability in Versions 0.16.2 and Below https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33125
Post summary
A vulnerability disclosure notes a privilege‑escalation flaw in Frigate NVR 0.16.2 or earlier; no PoC, exploit, patch, or active exploitation information is included.
0000048
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	frigate	frigate	-	-	-

Explore more

Back to dashboard frigate CVEs frigate vulnerabilities

What researchers are saying

CVE-2026-33125

PulsePatch.io@pulsepatchioDisclosure

The tweet announces a critical access control vulnerability in Frigte that lets viewer users delete admin accounts and advises users to monitor the vendor for patches.

CVE@CVEnewDisclosure

The text announces a new vulnerability in Frigate’s NVR, noting that viewer‑role users can delete administrative data in older releases, but it contains no PoC, exploit details, patch info, or evidence of ongoing exploitation.

RedPacket Security@RedPacketSecGeneral

The content merely announces a CVE reference via a URL without providing details on the vulnerability, PoC, exploits, or mitigations.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A vulnerability disclosure notes a privilege‑escalation flaw in Frigate NVR 0.16.2 or earlier; no PoC, exploit, patch, or active exploitation information is included.