Frigate NVR Updates: Security Fixes and UI Improvements

Transcript

Good morning, this is your Frigate NVR Updates for March 19th, 2026.

The development team merged eight pull requests yesterday, with security and user interface improvements taking center stage.

hawkeye217 addressed critical security issues with two merged PRs. The first fixed cross-camera authentication in timeline and media endpoints, preventing authenticated custom viewer role users from accessing unauthorized camera data. The second restricted the raw config endpoint to admin roles only, tightening security controls.

spanner3003 enhanced the UI configuration system by adding proper ConfigDict titles and docstrings to the AXEngine detector configuration. This ensures the detector displays correctly as "AXEngine NPU" in the new UI config form instead of showing as generic "Label" text.

Two bug fixes were also merged. ryzendigo corrected an operator precedence issue in detection type checking that was causing logic conditions to always evaluate as true. The same contributor fixed a volume control bug in the Live Dashboard View that was resetting all camera volumes when adjusting just one.

Documentation received attention from ZhaiSoul, who fixed Axera device installation configuration and removed deprecated ONVIF host environment variables from the reference docs.

hawkeye217 also contributed new contributing guidelines and updated the pull request template to help streamline future development contributions.

The remaining activity consisted of 22 additional commits, primarily translation updates through Weblate. Multiple language locales received significant updates, including Chinese Simplified, Slovenian, Korean, Persian, Hungarian, Armenian, Vietnamese, German, and Portuguese Brazilian translations.

What's next: The security improvements should enhance multi-user deployments, while the UI configuration updates will improve the setup experience for AXEngine detector users.

That's your Frigate NVR update for today.