CVE-2026-109356: LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController
LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase every deleted port on all visible devices.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated LibreNMS user with global read access is affected by the authorization gap. The account does not need port-delete privileges, but it must be able to access the devices whose deleted ports are targeted.
What does an attacker need to do to trigger the deletion?
The attacker needs a read-only account and must send a DELETE request to the /ports/purge endpoint. Supplying purge=all can irreversibly remove every deleted port on all devices visible to that account.
Which deployments are affected?
LibreNMS versions before 26.9.0 are affected. The provided information does not identify any configuration prerequisite beyond having global-read users and the vulnerable endpoint available.
How can administrators determine whether they may have been affected?
Review whether users with global-read access could have issued DELETE requests to /ports/purge, particularly with purge=all. Also check for unexpected disappearance of deleted-port records on devices visible to read-only accounts.