{"id":"CVE-2026-86090","aliases":["AZL-99690","EUVD-2026-71777","GHSA-jh82-5ccp-7w4v","GHSA-m22w-f647-vx88","UBUNTU-CVE-2026-86090"],"status":"published","title":"ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers","description":"ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00453,"percentile":0.39813,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-09-04T21:48:46Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"ntopng","fixed_in":["5.2.1-7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"ntopng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-7"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ntopng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1+dfsg1-2ubuntu1","2.0+dfsg1-1","2.2+dfsg1-1","2.2+dfsg1-1build1","2.2+dfsg1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ntopng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4+dfsg1-3","2.4+dfsg1-4","3.2+dfsg1-1","3.2+dfsg1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ntopng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8+dfsg1-2.1build3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ntopng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.1+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ntopng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.1+dfsg1-1","5.2.1+dfsg1-1ubuntu1","5.2.1+dfsg1-1ubuntu3","5.2.1+dfsg1-1ubuntu4"]}],"products":[{"vendor":"ntop","product":"ntopng"}],"references":[{"url":"https://github.com/ntop/ntopng/security/advisories/GHSA-m22w-f647-vx88","tags":["vendor-advisory","advisory"]},{"url":"https://github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc432f6bdd8","tags":["patch","fix"]},{"url":"https://github.com/ntop/ntopng","tags":["product","package"]},{"url":"https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/rest/v2/delete/endpoints.lua","tags":["technical-description","article"]},{"url":"https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/rest/v2/delete/recipients.lua","tags":["technical-description","article"]},{"url":"https://www.vulncheck.com/advisories/ntopng-before-6.7.260717-missing-authorization-on-the-notification-endpoint-and-recipient-delete-handlers","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86090","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jh82-5ccp-7w4v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86090.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86091.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86091","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/ntopng-before-6.7.260717-missing-authorization-on-the-host-pool-bulk-delete-handler","tags":["advisory"]},{"url":"https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/modules/pools/pools_rest_utils.lua","tags":["article"]},{"url":"https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/rest/v2/delete/pools.lua","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-86090","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86090","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-86090","title":"ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers","description":"ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.","status":"published","published":"2026-09-04T21:48:46.991Z","modified":"2026-09-14T19:33:07.533Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:49:42.666099Z"}],"euvd":[{"id":"EUVD-2026-71777","description":"ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.","status":"published","published":"2026-09-04T21:48:46Z","modified":"2026-09-14T19:33:07Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:19.383429Z"}],"ghsa":[{"id":"GHSA-jh82-5ccp-7w4v","title":"ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and...","description":"ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.","status":"published","published":"2026-09-05T00:31:05Z","modified":"2026-09-05T00:31:10Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:11:24.326884Z"}],"nvd":[{"id":"CVE-2026-86090","description":"ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.","status":"published","published":"2026-09-04T22:17:18.84Z","modified":"2026-09-23T17:17:46.823Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:44.082631Z"}],"osv":[{"id":"CVE-2026-86090","title":"ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers","description":"ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.","status":"published","published":"2026-09-04T21:48:46.991Z","modified":"2026-10-28T02:30:38.076472023Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:45:18.825071Z"},{"id":"CVE-2026-86091","title":"ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler","description":"ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.","status":"published","published":"2026-09-04T21:48:47.663Z","modified":"2026-10-28T02:30:31.410280861Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:45:18.825071Z"},{"id":"UBUNTU-CVE-2026-86090","description":"ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.","status":"published","published":"2026-09-04T22:17:00Z","modified":"2026-09-16T14:03:45.195921084Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"AZL-99690","title":"CVE-2026-86090 affecting package ntopng for versions less than 5.2.1-7","description":"ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.","status":"published","published":"2026-09-04T22:17:18Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"}]}}