Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
blakeblackshear/frigate
dev @ ec3fb00
38
Fixes
9
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 21 prior fixes. Scrutinize any change in this area.
frigate/api/auth.py: most-fixed (16 issues). Treat as high-risk during review.
24 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The authentication and authorization middleware has historically suffered from multiple structural flaws, including unvalidated header parsing, incorrect role list splitting, and missing camera-level permission checks. This allows attackers to bypass authentication entirely or escalate privileges to administrator status.
Command Injection: Media export processes utilize FFmpeg via system command execution. An easily bypassed blacklist approach historically exposed the application to command injection vulnerabilities, which required replacing with a strict, structural argument allowlist.
Auth Bypass: Camera-specific resource exposure failed to restrict requests to only authorized camera scopes. Attackers with low-privilege tokens could bypass boundaries and access streams, snapshots, and event databases belonging to other cameras.