CVE-2026-75607 Details
Description
Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware authorization to the handler. Any authenticated viewer can send admin-only topics such as restart, notifications/set, and camera detection, recording, snapshot, audio, motion, and enablement settings, causing service restarts or disabling security monitoring functions. Authentication must be enabled and valid viewer credentials are required. This issue is fixed in version 0.17.2.
A vulnerability in Frigate NVR prior to version 0.17.2 allows authenticated users with viewer roles to access and execute admin-only operations through WebSocket connections. The issue arises because the WebSocket handler does not verify the user's role, enabling viewers to send commands that can disrupt service or disable critical security functions. This vulnerability affects Frigate NVR version 0.17.1, the latest release at the time of discovery.
Users can update to Frigate NVR version 0.17.2 or later, where this vulnerability has been fixed. For those unable to update, it is recommended to review and adjust WebSocket authorization processes to ensure proper role-based access controls are in place.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/blakeblackshear/frigate/security/advisories/GHSA-r5fm-h944-8chq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/blakeblackshear/frigate/commit/0371b60c715b8e53deed419f742f69d08ccef491 | [email protected] | Source CodeVendor |
| https://github.com/blakeblackshear/frigate/pull/22710 | [email protected] | Issue TrackingVendor |
| https://github.com/blakeblackshear/frigate/releases/tag/v0.17.2 | [email protected] | Release NotesVendor |
| https://github.com/blakeblackshear/frigate/security/advisories/GHSA-r5fm-h944-8chq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Frigate | 0.17.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | New CVE Received | [email protected] |
| Sep 22, 2026 | CVE Modified | CISA-ADP |