What’s Vulnerable › Vulnerabilities

CVE-2026-84989: ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-03 · updated 2026-09-09
• Weakness: CWE-862

Description

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag.lua` — perform no authorization check at all. Any authenticated user, including a non-administrator ("unprivileged") account, can delete or rename any tag in the system, including tags created by an administrator. Version 6.7.260718 contains a fix.

Affected products

• ntopng: from 6.7.0, < 6.7.260718

References

• https://github.com/ntop/ntopng/commit/0e41f24b367fb9caf750459da67827326e3289e8
• https://github.com/ntop/ntopng/security/advisories/GHSA-43p9-5758-wwq8
• https://github.com/ntop/ntopng/security/advisories/GHSA-43p9-5758-wwq8

Get alerted when CVE-2026-84989 or the next vulnerability affects your stack