Frigte has broken access control viewer user can delete admin and other users account

Summary

Users with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity.

Details

Endpoint DELETE /api/users/admin is enable to anonymous user.

PoC

I deleted admin user on demo.frigate.video:

Impact

It this leads to denial of service and affects data integrity.

Recommended Fixes

Restrict access to the endpoint to authenticated admin users only: Add dependencies=[Depends(require_role(["admin"]))]) to this endpoint.