Executive brief
ntopng is a network traffic monitoring platform that uses REST APIs to manage notification endpoints and alert recipients. A flaw in authorization checks allows authenticated non-administrator users to delete all configured notification endpoints and recipients via POST requests, which silences all security alerts and could leave the organization blind to threats.
Technical details
ntopng versions before 6.7.260717 fail to perform proper authorization checks in the REST v2 delete handlers for notification endpoints and recipients (specifically in scripts/lua/rest/v2/delete/endpoints.lua and related handlers). The vulnerability is an authorization bypass (CWE-862) that affects REST API endpoints handling endpoint and recipient deletion. Authenticated users can issue POST requests to irreversibly delete all configured notification endpoints and recipients regardless of their privilege level. The attack requires valid authentication but no elevated privileges; the impact is high as it allows silencing all alerts. A patch is available in version 6.7.260717 and later.
Affected products
- ntop ntopng before 6.7.260717
Timeline
- 2026-09-04: disclosed