CVE-2026-86091CWE-862broken-access-control

CVE-2026-86091

High · published September 5, 2026

CVSS v3.1
7.1
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00517 · 43.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-05T02:17Z
References (7)
https://github.com/ntop/ntopng · [email protected]https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/modules/pools/pools_rest_utils.lua · [email protected]https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/rest/v2/delete/pools.lua · [email protected]https://github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc432f6bdd8 · [email protected]https://github.com/ntop/ntopng/security/advisories/GHSA-m22w-f647-vx88 · [email protected]https://www.vulncheck.com/advisories/ntopng-before-6.7.260717-missing-authorization-on-the-host-pool-bulk-delete-handler · [email protected]https://github.com/ntop/ntopng/security/advisories/GHSA-m22w-f647-vx88 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 21:48Z
    ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler
    cvelistv5