CVE-2026-86091

CVE-2026-86091 is a missing-authorization flaw (CWE-862) in ntopng's pools bulk-delete endpoint: versions before 6.7.260717 do not verify that the requesting user holds administrator privileges. Any authenticated non-administrator can trigger it by sending a POST request to the delete-pools endpoint, which irreversibly deletes every host pool and its member bindings. Host pools carry traffic policy bindings and visibility restrictions, so the attacker can wipe out policy enforcement and visibility controls enforced through those pools; there is no confidentiality impact, code execution, or data theft, just destructive configuration change. Any deployment running an ntopng version before 6.7.260717 that has non-administrator user accounts is affected, while installs operated solely by administrator accounts are largely insulated. No exploitation is currently known: there is no public PoC, the CVE is not in CISA KEV, and EPSS is 0.3% (21st percentile).

What to do: Upgrade to ntopng 6.7.260717 or later, which restores the privilege check on the bulk-delete endpoint. Until patched, restrict the ntopng web UI (bind to localhost, firewall it, or place it behind a VPN) and avoid granting accounts to untrusted users, since the flaw requires valid low-privileged credentials. Because deletions are irreversible, check whether host pools on affected installs are unexpectedly empty to detect past abuse.