CVE-2026-86090

ntopng before 6.7.260717 is missing authorization checks (CWE-862) in the REST v2 handlers that delete notification endpoints and recipients. Any authenticated non-administrator user can send a POST request to these handlers and irreversibly delete all configured notification endpoints and recipients. An attacker gains no code execution or data access, but can silently silence all alerting on the monitoring system, degrading the integrity and availability of notifications. Any ntopng deployment running an affected version that has provisioned low-privileged user accounts is affected. There is no public proof-of-concept, no CISA KEV listing, and no known in-the-wild exploitation; EPSS currently estimates a 0.2% probability of exploitation in the next 30 days.

What to do: Upgrade ntopng to 6.7.260717 or later. Until patched, restrict REST API access to trusted networks or administrative accounts and review which non-administrator users exist on the instance. After upgrading, verify that notification endpoints and recipients were not deleted and that alert delivery is functioning.