CVE-2026-54652 | Frigate is an open source network video recorder. In version… | CVSS 8.1 HIGH

Description

Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials logged in request query strings and enabling viewer-to-admin privilege escalation. A fixed release has not been identified.

Metadata

CVE ID: CVE-2026-54652
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-15 20:16 UTC
Published: 2026-07-08 14:52 UTC
Last updated: 2026-07-08 15:20 UTC
Primary CWE: CWE-269
CWE-269: Improper Privilege Management
Vendor / Product: blakeblackshear / frigate
Sources: cve.org · NVD

Severity & Metrics

8.1 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
blakeblackshear	frigate	—	<= 0.17.1

Weakness (CWE)

CWE	Source	Description
CWE-269	cna	CWE-269: Improper Privilege Management
CWE-532	cna	CWE-532: Insertion of Sensitive Information into Log File
CWE-598	cna	CWE-598: Use of GET Request Method With Sensitive Query Strings
CWE-863	cna	CWE-863: Incorrect Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.1	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References (3)

https://github.com/blakeblackshear/frigate/security/advisories/GHSA-c4qf-xxq4-vf55 https://github.com/blakeblackshear/frigate/security/advisories/GHSA-c4qf-xxq4-vf55
https://github.com/blakeblackshear/frigate/commit/68e8afd35c76f05f68de47ee9588d2c91796de4b https://github.com/blakeblackshear/frigate/commit/68e8afd35c76f05f68de47ee9588d2c91796de4b
https://github.com/blakeblackshear/frigate/commit/bd1fc1cc72cd4fa371464a087cbf3d7f3142edc6 https://github.com/blakeblackshear/frigate/commit/bd1fc1cc72cd4fa371464a087cbf3d7f3142edc6