Executive brief
ntopng is a web-based network traffic monitoring platform that organizations use to track and analyze network activity. This vulnerability allows any logged-in user, even non-administrators, to delete or rename system tags that administrators rely on for organizing network data, creating alerts, and building dashboards. An attacker with ordinary user access can corrupt the tag system and disrupt critical monitoring and alerting capabilities.
Technical details
The vulnerability is a missing authorization check (CWE-862) in two REST API v2 endpoints: POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua. Both endpoints manage ntopng's tag/badge feature but perform no role or privilege verification before executing tag deletion or modification operations. An authenticated user with network access to the ntopng web interface can exploit these endpoints to delete or rename any tag in the system by sending a crafted POST request with a valid session and CSRF token. The underlying tag_badge_utils Lua module also lacks authorization checks and directly modifies a shared Redis hash without ownership validation. ntopng version 6.7.260718 and later contain the fix.
Affected products
- ntop ntopng 6.7.0 through 6.7.260717
Timeline
- 2026-07-17: disclosed
- 2026-07-17: patched: Version 6.7.260718 released with fix