CVE-2026-83621 in ntopng
Summary
by MITRE • 09/21/2026
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scripts/lua/rest/v2/edit/system/edit_blacklist.lua lacks an administrator check and calls lists_utils.editList for any authenticated user. The list_name, list_enabled, url, and list_update parameters allow a non-admin user to redirect threat-intelligence downloads to attacker-controlled content, disable blocklists, or prevent scheduled updates. The changes are persisted through Redis and reloaded without a lower-level authorization guard, undermining the integrity and availability of ntopng's threat-intelligence monitoring. This issue is fixed in version 6.7.260717.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in ntopng prior to version 6.7.260717 represents a critical authorization bypass within the web-based network traffic monitoring application's administrative interface. Specifically, the endpoint located at POST /lua/rest/v2/edit/system/edit_blacklist.lua fails to enforce proper access control mechanisms for users possessing valid authentication credentials but lacking administrator privileges. This flaw allows any authenticated user, regardless of their role or permission level, to interact with functions that are intended exclusively for system administrators. The core technical deficiency lies in the application's failure to verify administrative status before invoking the lists_utils.editList function, which is responsible for modifying critical security configurations related to threat intelligence and blocklists.
The operational impact of this vulnerability is severe due to the nature of the parameters exposed through the vulnerable endpoint: list_name, list_enabled, url, and list_update. An attacker with low-privileged access can manipulate these inputs to redirect threat-intelligence downloads toward malicious servers controlled by the adversary. By altering the source URL for blocklist updates, the attacker ensures that ntopng fetches compromised data rather than legitimate security feeds. Furthermore, the ability to disable blocklists effectively removes a primary layer of defense against known threats, while preventing scheduled updates can lead to stale or missing threat intelligence. These actions directly undermine both the integrity and availability of the monitoring system's protective capabilities.
The persistence mechanism exacerbates the severity of this issue. Changes made through this unauthorized endpoint are stored in Redis, which serves as the backend data store for ntopng configurations. Crucially, these modifications are reloaded into the active application state without any lower-level authorization guard to validate their legitimacy upon reload. This means that once an attacker successfully exploits the vulnerability, the malicious configuration changes become immediately effective and persistent across service restarts or configuration refreshes. The lack of secondary validation ensures that the compromised settings remain in effect until manually corrected by a legitimate administrator who may be unaware of the unauthorized modifications made through this backdoor-like access path.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Assignment, as it allows users to perform actions reserved for higher-privileged roles. Additionally, the exploitation technique maps to ATT&CK T1078, Valid Accounts, where an attacker uses legitimate credentials to gain unauthorized access and manipulate system configurations. The ability to redirect threat feeds also touches upon CWE-94, Improper Control of Generation of Code, as it involves manipulating external data sources that influence application behavior in a security-critical manner.
To mitigate this risk, organizations running ntopng must immediately upgrade to version 6.7.260717 or later, where the authorization checks have been properly implemented for all administrative endpoints. Until an upgrade is feasible, administrators should restrict network access to the ntopng web interface to only trusted IP addresses and ensure that no non-administrative users are granted valid accounts with access to system configuration modules. Regular auditing of Redis data stores can also help detect unauthorized changes if they occur before a patch is applied.