CVE-2026-84989

ntopng, a web-based network traffic monitoring application, exposes two REST v2 endpoints for its tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — that perform no authorization check at all (CWE-862). Any authenticated user, including a non-administrator (unprivileged) account, can call these endpoints over the network to delete or rename any tag in the system, including tags created by an administrator. An attacker needs only a low-privilege login and no user interaction; per the CVSS 3.1 vector (7.1 high), the impact is high on integrity and low on availability with no confidentiality impact. Deployments running ntopng versions 6.7.0 through 6.7.260717 are affected, and version 6.7.260718 contains the fix. There is no evidence of active exploitation: the flaw is not in CISA KEV, EPSS puts the 30-day exploitation probability at 0.2% (12th percentile), and no public proof-of-concept is known.

What to do: Upgrade ntopng from 6.7.0–6.7.260717 to version 6.7.260718 or later. As an interim mitigation, restrict access to the /lua/rest/v2/delete/tag/tag.lua and /lua/rest/v2/edit/tag/tag.lua endpoints to administrators (e.g., via reverse-proxy or firewall access rules) and minimize the number of non-administrator accounts that can reach the REST v2 API. Review the tag list for unexpected renames or deletions that would indicate abuse.