Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape

Frigate has insecure password change functionality

Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations

Frigate viewer can read logs exposing admin and camera credentials

Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts

Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information

Frigate Vulnerable to Arbitrary File Read via Export Thumbnail "image_path" parameter

Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py`

In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service

Frigate cross-site request forgery in `config_save` and `config_set` request handlers

Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw

Frigate reflected XSS through `/<camera_name>` API endpoints

Frigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event_id}/snapshot-clean.webp

Frigate has SSRF vulnerability in /ffprobe endpoint