CVE-2026-84990: ntopng: Missing Authorization on System Configuration Backup Download and Listing
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download system-configuration backups without an administrator check. The download path reaches backupconfig.exportbackup, and prefsdumputils.buildprefsdumptable includes the ntopng.user. Redis key space in the backup. A downloaded backup can therefore disclose password hashes for local users and, when configured, API tokens, TOTP secrets, and WebAuthn credential data, enabling account compromise through usable or recoverable credentials. This issue is fixed in version 6.7.260718.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ntopngto a version that resolves this vulnerability.Fixed in 6.7.260718
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated ntopng user who is not an administrator can exploit it. The affected backup listing and download endpoints do not enforce an administrator authorization check.
What sensitive data may be exposed in a downloaded backup?
Backups include the ntopng.user.* Redis key space, which can expose local-user password hashes. Depending on configuration, they may also contain API tokens, TOTP secrets, and WebAuthn credential data.
Which versions are affected and what fixes the issue?
ntopng versions prior to 6.7.260718 are affected. Upgrade to version 6.7.260718 or later to obtain the fix.
How can I determine whether credentials may already have been exposed?
Review whether non-admin authenticated users could access the system configuration backup listing or download endpoints on an affected version. If backups were downloaded by unauthorized users, treat included local password hashes and any configured API tokens, TOTP secrets, or WebAuthn credential data as potentially exposed.