Authorization Bypass in ntopng REST v2 Handlers

The ntopng network traffic analysis tool contains an authorization flaw in the REST v2 API handlers responsible for managing notification endpoints and recipients. Before version 6.7.260717, these delete endpoints fail to verify the administrative privileges of the requesting user. Any user authenticated to the ntopng instance can issue unauthorized POST requests to delete configured notification endpoints and recipients. This action is irreversible and effectively disables the alerting pipeline for the network monitoring system, leading to a denial of service for administrative visibility. Because ntopng is frequently deployed in sensitive network monitoring segments, this vulnerability provides a trivial path for an authenticated attacker with low-privilege access to silence security monitoring and evade detection during subsequent malicious activities.

Impact

The vulnerability results in a denial of service for the alerting capabilities of ntopng, which may be exploited by an authenticated attacker to mask ongoing unauthorized network activity. All sectors utilizing ntopng for network traffic analysis are affected. Successful exploitation allows for the permanent loss of notification configurations, requiring manual re-configuration by administrators.

Recommendation

Prioritized actions for detection and mitigation:

• Upgrade all ntopng instances to version 6.7.260717 or later to address CVE-2026-86090.
• Monitor webserver access logs for high-frequency or unauthorized POST requests to REST v2 endpoints related to notification settings.
• Restrict access to the ntopng management interface to authorized administrative segments only.