Frigate EUVD-2026-84530

Exploitation requires that Frigate authentication is enabled and that the attacker holds valid viewer-level credentials (per the description and PR:L). The attacker then sends admin-only WebSocket message topics (e.g., restart, notifications/set, and per-camera detection, recording, snapshot, audio, motion, and enablement settings) to the frigate/comms/ws.py handler. The specific weakness is that the nginx authentication subrequest performs authentication but not role-aware authorization, so the handler never distinguishes viewer from admin. Limiting factors: no exploitation is possible without authentication enabled and a valid viewer account, so the realistic threat is an insider or a holder of a leaked/shared low-privilege credential rather than an anonymous internet attacker; deployments without multi-user/viewer accounts are effectively unexposed.

This is a genuine authorization flaw, not an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) accurately reflects a network-reachable, low-complexity attack that requires only low privileges (a valid viewer account) and no user interaction, yielding high integrity and availability impact with no confidentiality loss. CWE-862 (Missing Authorization) is confirmed by the source diff: ws.py forwarded attacker-chosen topics to the dispatcher with no role check because the nginx auth subrequest was not role-aware. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical priority is elevated for anyone running Frigate multi-user with viewer accounts, because the flaw lets a low-trust user restart the service or silently disable the very security-monitoring functions (detection, recording, motion, notifications) the product exists to provide - a direct integrity/availability threat to a surveillance system. The main mitigating factor is the authentication gate: exploitation is impossible unless auth is enabled and the attacker already holds valid viewer credentials, which bounds the threat to insiders or holders of leaked/shared low-privilege accounts.

An operator grants a low-trust user a viewer-only Frigate account (or a viewer credential leaks). That user opens an authenticated WebSocket to the frigate/comms/ws.py handler and sends admin-only topics such as 'restart' or camera detection/recording/enablement settings; the handler forwards them to the dispatcher without checking role, so the attacker restarts the service or disables recording and detection on cameras. No public exploit code is identified, but the attack requires only a standard WebSocket client and a valid viewer session.