LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete… (CVE-2026-109356)

The vulnerability in LibreNMS prior to version 26.9.0 is due to missing authorization checks in the PortsController::purge method. This allows an attacker with a global-read account, which normally only permits read access, to perform unauthorized DELETE operations on ports. By issuing a DELETE request to /ports/purge with the purge=all parameter, the attacker can permanently erase all deleted ports across all devices they can view. This is a privilege escalation issue where read-only users gain the ability to delete resources physically.

The impact is limited to integrity loss, as attackers with read-only access can delete port records without proper authorization. There is no confidentiality or availability impact reported. The deletion is irreversible, potentially causing data loss related to network port records in LibreNMS.

Upgrade LibreNMS to version 26.9.0 or later, where this authorization vulnerability has been fixed. Until then, restrict global-read user privileges or avoid exposing the /ports/purge endpoint to untrusted users. Patch status is not explicitly confirmed in the input data, but the vulnerability is described as fixed in 26.9.0, so upgrading to this version or later is recommended.