CVE-2026-54652 is an improper privilege management vulnerability (CWE-269) in the open source network video recorder Frigate. In versions before 0.17.1, the GET /api/logs/{service} API endpoint permits any authenticated user, including those with minimal viewer privileges, to access and download logs containing sensitive data such as auto-generated admin passwords and camera credentials. This exposure of sensitive information logged in request query strings can lead to privilege escalation from viewer to administrator. The vulnerability is rated with a CVSS 3.1 score of 8.1 (high severity), reflecting network attack vector, low attack complexity, and high impact on confidentiality and integrity. As of the published date, no official fix or patch release has been identified.

The vulnerability allows authenticated users with viewer-level access to retrieve sensitive log files containing admin passwords and camera credentials. This exposure can lead to unauthorized privilege escalation to admin level, compromising the security of the Frigate system and potentially the cameras it manages. The confidentiality and integrity of the system are highly impacted, while availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to authenticated users carefully and consider limiting viewer role permissions or disabling access to the /api/logs/{service} endpoint if possible. Monitor vendor communications for an official fix or update.