Executive brief
ntopng is a web-based network traffic monitoring tool used by organizations to monitor network security and performance. A privilege escalation vulnerability allows authenticated regular users to delete all host pools and traffic policies managed by administrators, disrupting network visibility and traffic control policies that protect the organization from unauthorized traffic.
Technical details
ntopng before version 6.7.260717 fails to validate user privileges in the pools bulk-delete REST endpoint, allowing authenticated non-administrator users to delete all host pools and associated member bindings. The vulnerable code is in scripts/lua/modules/pools/pools_rest_utils.lua, which processes POST requests to the delete pools endpoint without performing adequate authorization checks. An authenticated attacker can send bulk-delete requests to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions. This is a privilege escalation vulnerability requiring authentication but no additional user interaction. Patches are available in version 6.7.260717 and later.
Affected products
- ntop ntopng before 6.7.260717
Timeline
- 2026-09-04: disclosed