CVEvulnerability
CVE-2026-86091
7.1 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-09-04
- Last modified
- 2026-09-23
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 7.1 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
- Weaknesses
- CWE-862
Description
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://github.com/ntop/ntopng github.com
- https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/modules/pools/pools_rest_utils.lua github.com
- https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/rest/v2/delete/pools.lua github.com
- https://github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc432f6bdd8 github.com
- https://github.com/ntop/ntopng/security/advisories/GHSA-m22w-f647-vx88 github.com
- https://www.vulncheck.com/advisories/ntopng-before-6.7.260717-missing-authorization-on-the-host-pool-bulk-delete-handler www.vulncheck.com
- https://github.com/ntop/ntopng/security/advisories/GHSA-m22w-f647-vx88 github.com