CVE-2026-83621: fallo de gravedad alta en ntopng
ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.1epss 0.5%
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scripts/lua/rest/v2/edit/system/edit_blacklist.lua lacks an administrator check and calls lists_utils.editList for any authenticated user. The list_name, list_enabled, url, and list_update parameters allow a non-admin user to redirect threat-intelligence downloads to attacker-controlled content, disable blocklists, or prevent scheduled updates. The changes are persisted through Redis and reloaded without a lower-level authorization guard, undermining the integrity and availability of ntopng's threat-intelligence monitoring. This issue is fixed in version 6.7.260717.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Productos afectados
ntop · ntopngCVEs relacionadas — ntopng
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-82412HIGHntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST APIEPSS 0.7%CVE-2026-86091HIGHntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete HandlerEPSS 0.5%CVE-2026-86090HIGHntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete HandlersEPSS 0.5%CVE-2026-84989HIGHntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary TagsEPSS 0.4%CVE-2026-84990HIGHntopng: Missing Authorization on System Configuration Backup Download and ListingEPSS 0.3%CVE-2026-45448MEDIUMntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')EPSS 0.2%