Privilege Escalation Vulnerability in Frigate Network Video Recorder by Blake Blackshear

CVE-2026-54652

What is CVE-2026-54652?

Frigate, an open-source network video recorder, contains a vulnerability in its /api/logs/{service} endpoint that permits any authenticated user, including those with a viewer role, to access and download sensitive logs. This exposure can lead to the revelation of auto-generated administrative passwords and camera credentials, which may be included in log request query strings. Consequently, this vulnerability enables unauthorized privilege escalation from viewer to admin, posing a significant threat to the security of the system. No fix has been released to address this issue.

References