CVE-2026-33470
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras.
Published Mar 26, 2026 · updated Jun 17, 2026 · frigate frigate
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, a low-privilege authenticated user restricted to one camera can access snapshots from other cameras. This is possible through a chain of two authorization problems: returns timeline entries for cameras outside the caller's allowed camera set, then declares but never actually validates after looking up the event. Together, this allows a restricted user to enumerate event IDs from unauthorized cameras and then fetch clean snapshots for those events. Version 0.17.1 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 26, 2026 · NIST NVD
Detected
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, a low-privilege authenticated user restricted to one camera can access snapshots from other cameras. This is possible through a chain of two authorization problems: returns timeline entries for cameras outside the caller's allowed camera set, then declares but never actually validates
Jun 17, 2026 · NIST NVD
Updated
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, a low-privilege authenticated user restricted to one camera can access snapshots from other cameras. This is possible through a chain of two authorization problems: returns timeline entries for cameras outside the caller's allowed camera set, then declares but never actually validates
Affected
- cpe frigate/frigate0.17.0
Sources
- CVE.orgVulnerability recordCVE-2026-33470
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33470
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In version 0.17.0, a low-privilege authenticated user restricted to one camera can access snapshots from other cameras. This is possible through a chain of two authorization problems: `
nvd.nist.gov