CVE-2026-75607
Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware authorization to the handler. Any authenticated viewer can send admin-only topics such as restart, notifications/set, and camera detection, recording, snapshot, audio, motion, and enablement settings, causing service restarts or disabling security monitoring functions. Authentication must be enabled and valid viewer credentials are required. This issue is fixed in version 0.17.2.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
| NVDNVD · Deferred | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.64% · top 49% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.
Weakness
Affected products
- affected < 0.17.2
References (4)
- https://github.com/blakeblackshear/frigate/security/advisories/GHSA-r5fm-h944-8chq (opens in a new tab)x_refsource_CONFIRMexploit
- https://github.com/blakeblackshear/frigate/pull/22710 (opens in a new tab)x_refsource_MISC
- https://github.com/blakeblackshear/frigate/commit/0371b60c715b8e53deed419f742f69d08ccef491 (opens in a new tab)x_refsource_MISC
- https://github.com/blakeblackshear/frigate/releases/tag/v0.17.2 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-75607)Record last updated .