frigate — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in frigate, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-33470	Frigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event_id}/snapshot-clean.webp CWE-862	6.5	Medium	2026-03-26
CVE-2026-33469	Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw CWE-863	6.5	Medium	2026-03-26
CVE-2026-33126	Frigate has SSRF vulnerability in /ffprobe endpoint CWE-918	5.0	Medium	2026-03-20
CVE-2026-33125	Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts CWE-285	7.1	High	2026-03-20
CVE-2026-33124	Frigate has insecure password change functionality CWE-287	6.5	-	2026-03-20
CVE-2026-25643	Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape CWE-78	9.1	Critical	2026-02-06
CVE-2025-62382	Frigate Vulnerable to Arbitrary File Read via Export Thumbnail "image_path" parameter CWE-73	7.7	High	2025-10-15
CVE-2024-32874	In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service CWE-770	6.8	Medium	2024-05-09
CVE-2023-45672	Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py` CWE-502	7.5	High	2023-10-30
CVE-2023-45671	Frigate reflected XSS through `/<camera_name>` API endpoints CWE-79	4.7	Medium	2023-10-30
CVE-2023-45670	Frigate cross-site request forgery in `config_save` and `config_set` request handlers CWE-352	7.5	High	2023-10-30

All 11 known CVE vulnerabilities affecting frigate with full Chinese analysis, references, and POCs where available.