CVE-2026-84989 in ntopng
Summary
by MITRE • 09/03/2026
ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag.lua` — perform no authorization check at all. Any authenticated user, including a non-administrator ("unprivileged") account, can delete or rename any tag in the system, including tags created by an administrator. Version 6.7.260718 contains a fix.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in ntopng versions 6.7.0 through 6.7.260717 represents a critical failure in access control mechanisms within the application's web-based network traffic monitoring interface. Specifically, two REST v2 endpoints responsible for managing tags and badges are affected: POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua. These endpoints allow users to delete or rename existing tags that categorize and label various network flows and entities within the ntopng system. The core technical flaw is a complete absence of authorization checks on these specific API calls, meaning the server does not verify whether the authenticated user has sufficient privileges to perform actions on resources owned by other users or administrative accounts.
This lack of enforcement allows any authenticated user, regardless of their role or privilege level, including non-administrator unprivileged accounts, to manipulate tags created by administrators. In a typical deployment, ntopng is used for security monitoring and traffic analysis where accurate categorization via tags is essential for alerting, reporting, and forensic investigation. By allowing an unprivileged user to delete or rename administrative tags, the vulnerability undermines the integrity of the data classification system. An attacker could systematically remove critical tags associated with high-priority alerts or sensitive network segments, effectively blinding security teams to specific types of traffic or events. Alternatively, renaming these tags could lead to confusion in dashboards and reports, potentially causing analysts to misinterpret threat levels or miss malicious activity entirely due to misplaced categorization.
From a functional perspective, this vulnerability enables an attacker to disrupt the operational continuity of network monitoring efforts without needing elevated privileges. The impact extends beyond simple data corruption; it can serve as a precursor to more severe attacks by obscuring detection mechanisms. For instance, if tags are used to trigger specific alerts or automate responses based on traffic characteristics labeled with those tags, their removal could silence critical security notifications. This aligns with the MITRE ATT&CK framework technique of Impact via Defacement, where an adversary alters data to disrupt availability and trust in information systems. Furthermore, it falls under CWE-862: Missing Authorization, as the application fails to enforce proper access control policies for specific resources. It also relates to CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes, since users can modify attributes (tags) they do not own or have permission to change.
The remediation strategy is straightforward and has already been implemented in version 6.7.260718. Administrators running affected versions must upgrade ntopng immediately to the patched release where authorization checks are correctly enforced on these endpoints. Until upgrading is possible, organizations should consider network-level controls such as restricting access to the ntopng web interface to only trusted IP addresses or implementing a Web Application Firewall rule that blocks requests targeting these specific REST v2 paths unless they originate from authorized administrative sources. Additionally, reviewing audit logs for any suspicious tag modifications during the window of exposure can help assess whether an attack was attempted and what impact it may have had on monitoring capabilities.