CVE-2026-75608

Katalog CVE

CVSS 7.7 · High EPSS 0,37%

Kerentanan Incorrect Authorization. Skor CVSS 3.1 7.7 (High) menurut github.com.

Deskripsi (NVD)

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. Non-GET methods remain blocked by limit_except GET. This issue is fixed in version 0.18.0.

Rincian

Terbit di NVD

22 September 2026

Terakhir diubah

28 September 2026

Status NVD

Deferred

CVSS 3.1

7.7 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/blakeblackshear/frigate/commit/520d9eeb7f0fe46021f29fb8169741dd1d429271
• https://github.com/blakeblackshear/frigate/pull/22735
• https://github.com/blakeblackshear/frigate/releases/tag/v0.18.0
• https://github.com/blakeblackshear/frigate/security/advisories/GHSA-mgh5-cr9h-g6hr