CVE-2026-84989: ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags
ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check at all. Any authenticated user, including a non-administrator ("unprivileged") account, can delete or rename any tag in the system, including tags created by an administrator. Version 6.7.260718 contains a fix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.7.260718Patch Version 6.7.260718 contains a fix
Event History
Frequently Asked Questions
Which deployments are exposed?
ntopng versions 6.7.0 through 6.7.260717 are affected if users can authenticate to the ntopng web application. Any authenticated account, including an unprivileged non-administrator account, can invoke the affected REST endpoints.
What level of access does an attacker need?
The attacker needs valid authenticated access to ntopng, but does not need administrator privileges or user interaction. The vulnerable endpoints are POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua.
What can a non-administrator do through the vulnerable endpoints?
A non-administrator can delete arbitrary tags or rename arbitrary tags, including tags created by an administrator. The issue affects ntopng's tag/badge management feature.
What version fixes the issue?
Version 6.7.260718 contains the fix. Systems running versions from 6.7.0 through 6.7.260717 should be treated as affected.