What is CVE-2026-33125?

CVE-2026-33125 is a high-severity vulnerability in Blakeblackshear Frigate, classified under Improper Authorization. CVSS score: 7.1/10. Published 2026-03-20.

How severe is CVE-2026-33125?

High severity. CVSS v3 base score is 7.1 out of 10.

Auth bypass in Blakeblackshear Frigate

CVE-2026-33125

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version 0.16.3.

Published 2026-03-20 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H.

EPSS exploit prediction

EPSS: 0.004 (28.2th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 28.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.004 · change: +0.001

Affected products

Blakeblackshear Frigate — versions < 0.16.3
Frigate

Weakness classification (CWE)

CWE-285 — Improper Authorization

References

github.com/blakeblackshear/frigate/security/advisories/GHSA-vg28-83rp-8xx4 (Exploit, Vendor Advisory)
github.com/blakeblackshear/frigate/releases/tag/v0.16.3 (Release Notes)

Frequently asked questions

What is CVE-2026-33125?: CVE-2026-33125 is a high-severity vulnerability in Blakeblackshear Frigate, classified under Improper Authorization. CVSS score: 7.1/10. Published 2026-03-20.
How severe is CVE-2026-33125?: High severity. CVSS v3 base score is 7.1 out of 10.