Description

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag.lua` — perform no authorization check at all. Any authenticated user, including a non-administrator ("unprivileged") account, can delete or rename any tag in the system, including tags created by an administrator. Version 6.7.260718 contains a fix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-03T15:17:36.680Z",
  "pubdate": "2026-09-03T15:17:36.680Z",
  "executiveSummary": "ntopng versions 6.7.0 through 6.7.260717 are susceptible to a critical Broken Access Control vulnerability residing within the REST v2 API endpoints responsible for tag management. This security flaw allows any authenticated user, regardless of their assigned privilege level, to perform unauthorized destructive or administrative operations on system tags.\nThe vulnerability manifests as a complete lack of authorization checks on the POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua endpoints. By failing to validate the session owner's permissions against the requested resource modification, the application permits unprivileged accounts to delete or rename tags originally created by administrative users.\nThe impact includes the potential for unauthorized data manipulation, loss of visibility, or interference with security monitoring workflows that rely on specific tag taxonomy. This vulnerability significantly lowers the security posture of multi-user ntopng instances, as it enables low-privilege users to sabotage administrative configuration settings. Exploitation does not require elevated access, only standard authentication to the web interface. Users are advised to upgrade to version 6.7.260718 or later to remediate the flaw.",
  "technicalDetails": "The root cause of this vulnerability is an improper access control implementation within the ntopng REST v2 architecture. Specifically, the Lua-based backend scripts associated with tag management do not verify the user's role or object ownership before executing state-changing operations.\nThe affected endpoints are /lua/rest/v2/delete/tag/tag.lua and /lua/rest/v2/edit/tag/tag.lua. These endpoints are designed to handle tag lifecycle operations, but they fail to enforce the principle of least privilege. In a secure implementation, these endpoints should intercept the user's session identifier and cross-reference it against an Access Control List (ACL) or role-based permission set to ensure the authenticated user possesses the administrative rights necessary to modify or purge tags.\nThe exploitation flow is straightforward and does not require complex bypass techniques. An attacker with a standard, low-privilege account authenticates to the ntopng web interface. Using browser developer tools or a proxy utility (e.g., Burp Suite or OWASP ZAP), the attacker observes the traffic sent to the target REST endpoints. The attacker can then manually craft or replay POST requests to these endpoints targeting tags that belong to administrators or other system-level entities. Because the server-side code omits a mandatory authorization check, the ntopng application processes the request and executes the requested database operation.\nThis vulnerability is classified as Broken Access Control because the system assumes that any request originating from an authenticated session is implicitly authorized. The scope of the impact includes: (1) Unauthenticated deletion of operational tags, leading to a disruption of monitoring policies; (2) Unauthorized modification of tag metadata, which can be used to disrupt reporting or misclassify network traffic; and (3) Circumvention of organizational security policies regarding resource management.\nThe vulnerability affects ntopng versions 6.7.0 through 6.7.260717. The exposure is limited to authenticated environments, meaning that public-facing ntopng instances are at higher risk if they allow user registration or shared credentials. Post-exploitation impact is focused on integrity violations of the configuration data rather than direct remote code execution; however, the ability for an unprivileged user to alter administrative monitoring parameters facilitates further malicious activities such as masking unauthorized traffic or obfuscating network activity logs."
}