CVE-2026-75608

Name of the Vulnerable Software and Affected Versions Frigate versions prior to 0.18.0

Description An authentication bypass exists where the prefix-matched location '/api/go2rtc/api' requires authentication but fails to enforce an administrator role for GET requests. This exposes the proxied go2rtc API to users with viewer privileges. An authenticated viewer can access the streams, config, log, and stack subpaths to retrieve internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs, which may include camera credentials. Non-GET methods are blocked by the limit except GET directive.

Recommendations Update to version 0.18.0.