From c2220c89a9520ae943c797241238ae80ce09be97 Mon Sep 17 00:00:00 2001
From: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
Date: Tue, 31 Mar 2026 12:51:35 -0500
Subject: [PATCH] enforce camera access in thumbnail tracked-object fallback

The /events/{id}/thumbnail endpoint called require_camera_access when
loading persisted events but skipped the check in the tracked-object
fallback path for in-progress events. A restricted viewer could
retrieve thumbnails from cameras they should not have access to.
---
 frigate/api/media.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/frigate/api/media.py b/frigate/api/media.py
index fd48a11e14..43a82b26f3 100644
--- a/frigate/api/media.py
+++ b/frigate/api/media.py
@@ -896,6 +896,9 @@ async def event_thumbnail(
                 if event_id in camera_state.tracked_objects:
                     tracked_obj = camera_state.tracked_objects.get(event_id)
                     if tracked_obj is not None:
+                        await require_camera_access(
+                            camera_state.name, request=request
+                        )
                         thumbnail_bytes = tracked_obj.get_thumbnail(extension.value)
         except Exception:
             return JSONResponse(