CVE-2026-86091: Missing Authorization in ntop ntopng
Description
ntopng versions before 6.7.260717 contain a missing authorization vulnerability in the pools bulk-delete endpoint. Authenticated users without administrative privileges can delete all host pools and member bindings. This action irreversibly removes traffic policy bindings and visibility restrictions, potentially bypassing security controls.
CVSS v4.0
Score 7.1high
Affected software
ntop
ntopng
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86091 is a missing authorization vulnerability in ntopng prior to version 6.7.260717. The flaw exists in the pools bulk-delete endpoint, which fails to verify user privileges properly. As a result, authenticated non-administrative users can issue POST requests to delete all host pools and their member bindings. This leads to the destruction of traffic policy bindings and visibility restrictions, undermining security policies enforced by the application.
Potential Impact
An attacker with valid authentication but without administrative rights can delete all host pools and associated member bindings. This irreversible deletion removes traffic policy bindings and visibility restrictions, potentially allowing unauthorized traffic flows and bypassing security policies that rely on these controls. The vulnerability has a CVSS 4.0 score of 7.1, indicating high severity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the pools bulk-delete endpoint to trusted administrators only and monitor for unauthorized use of this functionality.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-04T20:47:22.899Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9bf6b4acd9273b49bd464a
Added to database: 09/05/2026, 11:02:12 UTC
Last enriched: 09/15/2026, 00:52:04 UTC
Last updated: 10/20/2026, 18:48:24 UTC
Views: 113
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.