# CVE-2026-86090: ntopng authorization bypass in delete endpoints REST handlers

Source: https://junglewise.ai/threats/cve-2026-86090-ntopng-authorization-bypass-in-delete-endpoints-rest-handlers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86090 · Severity: high · CVSS 7.1 · Published 2026-09-04

ntopng is a network traffic monitoring platform that uses REST APIs to manage notification endpoints and alert recipients. A flaw in authorization checks allows authenticated non-administrator users to delete all configured notification endpoints and recipients via POST requests, which silences all security alerts and could leave the organization blind to threats.

Technologies: [Ntopng](https://junglewise.ai/threats/technologies/ntopng). Vendors: [Ntop](https://junglewise.ai/threats/vendors/ntop).

## Quick answers

**Is CVE-2026-86090 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86090 being exploited in the wild.

**How severe is CVE-2026-86090?** High severity, with a CVSS score of 7.1, published 4 September 2026.

**Which products and versions are affected?** Ntopng before 6.7.260717.

**Is there a fix for CVE-2026-86090?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86090 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86090?** Check whether you run Ntopng at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

ntopng versions before 6.7.260717 fail to perform proper authorization checks in the REST v2 delete handlers for notification endpoints and recipients (specifically in scripts/lua/rest/v2/delete/endpoints.lua and related handlers). The vulnerability is an authorization bypass (CWE-862) that affects REST API endpoints handling endpoint and recipient deletion. Authenticated users can issue POST requests to irreversibly delete all configured notification endpoints and recipients regardless of their privilege level. The attack requires valid authentication but no elevated privileges; the impact is high as it allows silencing all alerts. A patch is available in version 6.7.260717 and later.

## Affected products

- ntop ntopng before 6.7.260717

## Timeline

- 2026-09-04: disclosed

## References

- [https://github.com/ntop/ntopng](https://github.com/ntop/ntopng)
- [https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/rest/v2/delete/endpoints.lua](https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/rest/v2/delete/endpoints.lua)

## Related threats

- [ntopng stack buffer overflow in nDPI custom category detection](https://junglewise.ai/threats/cve-2026-97371-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng OS command injection in vulnerability-scan REST endpoint](https://junglewise.ai/threats/cve-2026-82413-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng authorization bypass in system configuration backup download](https://junglewise.ai/threats/cve-2026-84990-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng missing authorization check in blacklist editor](https://junglewise.ai/threats/cve-2026-83621-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng remote code execution via unauthenticated scan endpoints](https://junglewise.ai/threats/cve-2026-82412-ntopng-is-a-web-based-network-traffic-monitoring-application)