CVE-2026-75607: Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations
Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware authorization to the handler. Any authenticated viewer can send admin-only topics such as restart, notifications/set, and camera detection, recording, snapshot, audio, motion, and enablement settings, causing service restarts or disabling security monitoring functions. Authentication must be enabled and valid viewer credentials are required. This issue is fixed in version 0.17.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frigateto a version that resolves this vulnerability.Fixed in 0.17.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Frigate deployments running versions before 0.17.2 with authentication enabled are exposed when a user has valid viewer-level credentials. The issue affects the WebSocket handler's authorization of privileged message topics.
What access does an attacker need?
An attacker needs valid authenticated viewer credentials. No administrator role or user interaction is required, and the attacker can send admin-only WebSocket topics to perform actions such as restarting the service or changing monitoring-related settings.
Are unauthenticated users able to exploit this issue?
No. Authentication must be enabled, and exploitation requires valid viewer credentials.
How can I remediate the issue?
Upgrade Frigate to version 0.17.2, which fixes the missing role-aware authorization in the WebSocket handler.