# CVE-2026-109356: LibreNMS missing authorization in PortsController::purge

Source: https://junglewise.ai/threats/cve-2026-109356-librenms-before-26-9-0-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109356 · Severity: medium · CVSS 4.3 · Published 2026-10-12

LibreNMS is a network monitoring platform that tracks device and port information for auditing and capacity planning. A missing authorization check in the port purge feature allows read-only user accounts to irreversibly delete port records from the database without having delete permissions, including bulk deletion of all ports across visible devices using the purge=all option.

Technologies: [Librenms](https://junglewise.ai/threats/technologies/librenms). Vendors: [Librenms](https://junglewise.ai/threats/vendors/librenms).

## Quick answers

**Is CVE-2026-109356 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109356 being exploited in the wild.

**How severe is CVE-2026-109356?** Medium severity, with a CVSS score of 4.3, published 12 October 2026.

**Which products and versions are affected?** Librenms before 26.9.0.

**Is there a fix for CVE-2026-109356?** Yes: fixed in 26.9.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109356 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109356?** Check whether you run Librenms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.9.0

## Technical details

PortsController::purge uses Port::hasAccess() as a visibility scope filter rather than checking for explicit delete capability, allowing authenticated users with only read privileges (view/viewAll) to issue DELETE requests to /ports/purge and physically remove port entries from the database. The vulnerability is amplifiable via the purge=all parameter, which deletes every soft-deleted port on all visible devices. A fix requires an explicit capability check (port.delete) in addition to the visibility scope check.

## Affected products

- LibreNMS LibreNMS before 26.9.0

## Timeline

- 2026-09-23: disclosed
- 2026-10-12: advisory

## References

- [https://github.com/librenms/librenms/security/advisories/GHSA-9qcg-rgg9-mpjg](https://github.com/librenms/librenms/security/advisories/GHSA-9qcg-rgg9-mpjg)
- [https://www.vulncheck.com/advisories/librenms-before-26.9.0-missing-authorization-in-port-purge-via-portscontroller](https://www.vulncheck.com/advisories/librenms-before-26.9.0-missing-authorization-in-port-purge-via-portscontroller)

## Related threats

- [LibreNMS LDAP filter injection in external authorization modes](https://junglewise.ai/threats/cve-2026-109357-librenms-before-26-9-0-contains-an-ldap-filter-injection-in-ldap)
- [LibreNMS stored cross-site scripting in Oxidized node list](https://junglewise.ai/threats/cve-2026-109355-librenms-before-26-9-0-contains-a-stored-cross-site-scripting)
- [LibreNMS path traversal in NFSen channel parameter](https://junglewise.ai/threats/cve-2026-109354-librenms-before-26-9-0-contains-a-path-traversal-vulnerability)
- [LibreNMS SQL injection in notifications.inc.php](https://junglewise.ai/threats/cve-2026-109353-librenms-before-26-9-0-contains-an-sql-injection-vulnerability)
- [LibreNMS stored cross-site scripting in wireless sensor description](https://junglewise.ai/threats/cve-2026-109352-librenms-before-26-9-0-contains-a-stored-cross-site-scripting)