CVE-2026-86090
ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.
- Record
CVE-2026-86090- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-71777
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.
- Record
EUVD-2026-71777- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jh82-5ccp-7w4v
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and...
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.
- Record
GHSA-jh82-5ccp-7w4v- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.
- Record
CVE-2026-86090- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.
- Record
CVE-2026-86090- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVCVE-2026-86091
ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.
- Record
CVE-2026-86091- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-86090
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.
- Record
UBUNTU-CVE-2026-86090- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVAZL-99690 No score
CVE-2026-86090 affecting package ntopng for versions less than 5.2.1-7
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.
- Record
AZL-99690- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ntopngAzure Linux:3 |
before 5.2.1-7 | 5.2.1-7 |
ntopngUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.2.1+dfsg1-2ubuntu12.0+dfsg1-12.2+dfsg1-12.2+dfsg1-1build12.2+dfsg1-1ubuntu0.1~esm2 |
None known |
ntopngUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.4+dfsg1-32.4+dfsg1-43.2+dfsg1-13.2+dfsg1-1ubuntu0.1~esm2 |
None known |
ntopngUbuntu:20.04:LTS |
All versions, plus listed versions 3.8+dfsg1-2.1build3 |
None known |
ntopngUbuntu:22.04:LTS |
All versions, plus listed versions 5.2.1+dfsg1-1 |
None known |
ntopngUbuntu:24.04:LTS |
All versions, plus listed versions 5.2.1+dfsg1-15.2.1+dfsg1-1ubuntu15.2.1+dfsg1-1ubuntu35.2.1+dfsg1-1ubuntu4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-86090 is a high vulnerability (CVSS 7.1) in Ntop Ntopng, published September 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in ntopng 5.2.1-7.
References
github.com/ntop/ntopng/security/advisories/GHSA-m22w-f647-vx88
vulncheck.com/advisories/ntopng-before-6.7.260717-missing-authorization-on-the-notification-endpoint-and-recipient-delete-handlers
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-86090
ubuntu.com/security/CVE-2026-86090
cve.org/CVERecord?id=CVE-2026-86090