CVE-2026-75608

{
  "etk_id": "ETK-2026-1847",
  "cve_id": "CVE-2026-75608",
  "display_id": "CVE-2026-75608",
  "ghsa_id": "GHSA-mgh5-cr9h-g6hr",
  "euvd_id": "EUVD-2026-84531",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper authorization in Frigate's go2rtc API proxy",
  "summary": "Frigate versions before 0.18.0 do not restrict viewer-role GET requests to the proxied go2rtc API. An authenticated viewer can retrieve internal configuration and diagnostic data, including stream URLs that may contain camera credentials. Exploitation requires valid credentials for a viewer-role or other authenticated account.",
  "mitigation": "Upgrade Frigate to version 0.18.0 or later. Until upgrading, restrict access to the go2rtc API proxy to administrators and block viewer access to its sensitive subpaths.",
  "vendor": "blakeblackshear",
  "product": "frigate",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "0.17.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": null,
      "purl": null
    }
  ],
  "cwes": [
    863
  ],
  "cvss_score": 7.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
  "epss_score": 0.0037,
  "epss_percentile": 0.2906,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.715836016666668,
  "t0_at": "2026-09-22T15:36:56.512000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-06-28T12:19:59+00:00",
      "days": -86.13677675925926,
      "is_lower_bound": false,
      "measured_at": "2026-09-22T15:36:56.512000+00:00",
      "url": "https://github.com/blakeblackshear/frigate/security/advisories/GHSA-mgh5-cr9h-g6hr"
    },
    "trigger_signal": {
      "at": "2026-09-22T15:36:56.512000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-22T15:36:56.512000+00:00",
      "url": "https://github.com/blakeblackshear/frigate/security/advisories/GHSA-mgh5-cr9h-g6hr"
    }
  }
}