What is the CVSS score of CVE-2026-33470?

CVE-2026-33470 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Frigate are affected by CVE-2026-33470?

Organizations using Frigate should be aware of notable risk from CVE-2026-33470, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-33470?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Frigate CVE-2026-33470

EUVD-2026-16267 MEDIUM

Missing Authorization (CWE-862)

2026-03-26 GitHub_M

Authentication Bypass Frigate Blakeblackshear

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 17:15 euvd

EUVD-2026-16267

Analysis Generated

Mar 26, 2026 - 17:15 vuln.today

CVE Published

Mar 26, 2026 - 17:06 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, a low-privilege authenticated user restricted to one camera can access snapshots from other cameras. This is possible through a chain of two authorization problems: /api/timeline returns timeline entries for cameras outside the caller's allowed camera set, then /api/events/{event_id}/snapshot-clean.webp declares Depends(require_camera_access) but never actually validates event.camera after looking up the event. Together, this allows a restricted user to enumerate event IDs from unauthorized cameras and then fetch clean snapshots for those events. Version 0.17.1 fixes the issue.

AnalysisAI

Frigate network video recorder versions prior to 0.17.1 allow authenticated users with restricted camera access to enumerate and retrieve snapshots from unauthorized cameras through a two-step authorization bypass in the timeline and snapshot APIs. An attacker with low-privilege credentials limited to one camera can exploit missing validation in the snapshot-clean.webp endpoint to access video evidence from other cameras in the system, compromising the confidentiality of surveillance data across the entire installation. A proof-of-concept exists, though no confirmation of active exploitation in the wild has been reported.

Technical ContextAI

Frigate is a network video recorder application (cpe:2.3:a:blakeblackshear:frigate) that performs local object detection on IP camera streams. The vulnerability exploits a chain of two authorization flaws in the REST API layer. First, the /api/timeline endpoint fails to enforce camera access restrictions and returns timeline entries for all cameras in the system regardless of the caller's permitted camera set. Second, the /api/events/{event_id}/snapshot-clean.webp endpoint declares a Depends(require_camera_access) dependency but never validates that the retrieved event's camera property matches the caller's allowed cameras after lookup. This represents a CWE-862 (Missing Authorization) vulnerability where access control checks are either missing or incomplete in the snapshot retrieval logic, allowing privilege escalation from single-camera access to multi-camera access.

RemediationAI

Upgrade Frigate to version 0.17.1 or later immediately, as the vendor has released a patch that addresses both the timeline authorization bypass and the snapshot endpoint validation flaw. Instructions for upgrading are available in the GitHub security advisory at https://github.com/blakeblackshear/frigate/security/advisories/GHSA-m2mg-pj9p-2r7g. Until patching is completed, restrict API access to Frigate instances by implementing network-level access controls, such as IP whitelisting or VPN-gating for all API endpoints. Additionally, review and minimize the scope of low-privilege API credentials currently in use, and consider disabling snapshot API endpoints entirely if they are not actively required for your deployment.