CVE-2026-75607
Deferred Deferred - Pending Action

Privilege Escalation in Frigate NVR via WebSocket Topic Manipulation

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware authorization to the handler. Any authenticated viewer can send admin-only topics such as restart, notifications/set, and camera detection, recording, snapshot, audio, motion, and enablement settings, causing service restarts or disabling security monitoring functions. Authentication must be enabled and valid viewer credentials are required. This issue is fixed in version 0.17.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-75607
EUVD
EUVD-2026-84530

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
blakeblackshear frigate 0.17.2
blakeblackshear frigate 0.17.1
frigate frigate to 0.17.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-75607 is a critical authorization bypass in Frigate NVR version 0.17.1. It allows any authenticated user, including those with a viewer role, to execute administrative operations by exploiting a WebSocket handler that does not verify user roles. The nginx authentication subrequest does not pass role information to the WebSocket handler, causing it to process admin-only commands without proper authorization.

Detection Guidance

To detect this vulnerability, monitor WebSocket traffic for unauthorized admin commands from non-admin users. Check Frigate logs for suspicious activity like service restarts or disabled features. Use network tools to inspect WebSocket messages for topics like restart, notifications/set, or camera settings being accessed by viewer roles.

Impact Analysis

An attacker with viewer credentials could restart the Frigate service, disable security monitoring functions like object detection, recording, audio, motion detection, snapshots, and notifications. They could also manipulate camera settings, send PTZ commands to physically move cameras, or alter motion detection thresholds to create blind spots. The UI would still show these features as active while they are disabled.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as camera streams and recordings, violating privacy and security requirements under GDPR and HIPAA. Disabling security monitoring functions may also breach compliance mandates for continuous surveillance and data protection.

Mitigation Strategies

Upgrade Frigate to version 0.17.2 or later to apply the role-based authorization fix. Ensure nginx auth_request passes user role information to the WebSocket handler. Review and restrict viewer role permissions to read-only access. Monitor logs for unauthorized WebSocket commands and block suspicious traffic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75607. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart