CVE-2026-86091
ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.
| CWE | CWE-862 |
| Vendor | ntop |
| Product | ntopng |
| Published | Sep 4, 2026 |
| Last Updated | Sep 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for ntop ntopng
Be the first to know when new high vulnerabilities affecting ntop ntopng are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Affected Versions
ntop / ntopng
0 < 6.7.260717
References
github.com: https://github.com/ntop/ntopng/security/advisories/GHSA-m22w-f647-vx88 github.com: https://github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc432f6bdd8 github.com: https://github.com/ntop/ntopng github.com: https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/rest/v2/delete/pools.lua github.com: https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/modules/pools/pools_rest_utils.lua vulncheck.com: https://www.vulncheck.com/advisories/ntopng-before-6.7.260717-missing-authorization-on-the-host-pool-bulk-delete-handler
Credits
George Chen