CVE-2026-86090 in Ntopng
Summary
by MITRE • 09/05/2026
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in ntopng versions prior to 6.7.260717 represents a critical failure in access control mechanisms within the application's REST API layer. Specifically, the flaw resides in the handlers for deleting notification endpoints and recipients via the v2 interface. In a properly secured system, any operation that modifies configuration state or deletes persistent data must verify not only that the user is authenticated but also that they possess the requisite administrative privileges to perform such destructive actions. However, ntopng fails to enforce these authorization checks on the delete endpoints for both notification configurations and recipient lists. This oversight allows any validly authenticated user, regardless of their role or permission level within the system, to execute commands intended exclusively for administrators.
From a technical perspective, this is a classic example of broken access control where the server-side logic does not validate the privilege level associated with the session token before processing state-changing requests. The affected endpoints accept POST requests that trigger irreversible deletion operations on critical alerting infrastructure components. Because the application relies solely on authentication to gate these actions rather than implementing robust authorization checks, an attacker who has obtained low-privilege credentials can escalate their impact significantly without needing further exploitation steps or privilege escalation techniques. This architectural flaw bypasses the principle of least privilege, which dictates that users should only have access to resources necessary for their specific functions.
The operational impact of this vulnerability is severe and potentially catastrophic for network monitoring operations. By deleting all configured notification endpoints and recipients, an attacker can effectively silence all alerts generated by ntopng. This action creates a blind spot in the security posture of the monitored environment, as critical events such as intrusion attempts, policy violations, or anomalous traffic patterns will no longer trigger notifications to security teams or automated response systems. The irreversibility of this deletion means that restoring alerting capabilities requires manual reconfiguration by an administrator who may not immediately notice the absence of alerts if monitoring dashboards are still displaying data but failing to notify on events. This can lead to prolonged undetected compromise and significant delays in incident response times, as security teams remain unaware of ongoing attacks until other detection mechanisms or external audits reveal the issue.
This vulnerability aligns with CWE-269, which describes Improper Privilege Control, specifically where a user is able to perform actions that exceed their assigned privileges. Furthermore, it maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation relies on using legitimate credentials to disrupt security monitoring capabilities. It also relates to T1562, Impair Defenses, specifically through disabling or modifying tools used for defense detection and analysis. The ability to silence alerts is a common tactic in advanced persistent threat campaigns aimed at maintaining persistence and evading detection during lateral movement or data exfiltration phases.
To mitigate this risk, organizations running ntopng must immediately upgrade to version 6.7.260717 or later, where the authorization checks for these specific endpoints have been corrected. Until an upgrade is feasible, administrators should implement network-level controls such as firewall rules or reverse proxy configurations that restrict access to the REST API delete endpoints exclusively from trusted administrative IP addresses or internal management networks. Additionally, enforcing strict role-based access control policies and regularly auditing user permissions can help minimize the attack surface if similar vulnerabilities exist in other parts of the application. Regular security assessments focusing on broken object level authorization flaws are recommended to ensure that no other endpoints suffer from similar deficiencies in privilege validation logic.