CVE-2026-83621: ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled, url, and listupdate parameters allow a non-admin user to redirect threat-intelligence downloads to attacker-controlled content, disable blocklists, or prevent scheduled updates. The changes are persisted through Redis and reloaded without a lower-level authorization guard, undermining the integrity and availability of ntopng's threat-intelligence monitoring. This issue is fixed in version 6.7.260717.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ntopngto a version that resolves this vulnerability.Fixed in 6.7.260717 - Compensating control
Until upgraded, restrict access to the ntopng REST endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua so only administrators (or trusted users) can call it, e.g., via network ACL/WAF rules based on authenticated user role or source IP.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated ntopng user, including a non-administrative user, can exploit the affected REST endpoint. No administrator privileges or user interaction are required.
What can an attacker change through the vulnerable endpoint?
A non-admin user can alter blacklist URLs, enable or disable blocklists, and modify list update settings. This can redirect threat-intelligence downloads to attacker-controlled content or stop scheduled updates.
Are the unauthorized changes temporary?
No. The changes are persisted through Redis and reloaded, so they can continue affecting threat-intelligence monitoring after the request is made.
Which versions are affected and what fixes the issue?
ntopng versions prior to 6.7.260717 are affected. The issue is fixed in version 6.7.260717.