Missing Authorization in ntopng Allows Host Pool Deletion by Non-Administrators

CVE-2026-86091

What is CVE-2026-86091?

The ntopng software prior to version 6.7.260717 exhibits a serious vulnerability where it does not properly validate user permissions in the bulk-delete endpoint for host pools. This oversight allows authenticated users without administrative rights to issue POST requests that can irreversibly delete all host pools and their associated member bindings. Consequently, an attacker could exploit this flaw to bypass traffic management rules and visibility restrictions imposed by security policies, significantly undermining the application's integrity.

References