Description

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-04T22:17:18.840Z",
  "pubdate": "2026-09-04T22:17:18.840Z",
  "executiveSummary": "The vulnerability involves an improper authorization flaw within the ntopng REST v2 API handlers. Specifically, the delete endpoints for notification recipients and configured endpoints lack mandatory access control checks. This allows an authenticated non-administrative user to execute unauthorized administrative actions.\nThe primary impact of this vulnerability is the potential for a complete loss of configured notification and alerting systems. By programmatically triggering the deletion of these entities, an attacker can effectively disable the monitoring and alerting capabilities of the ntopng instance.\nThe flaw affects ntopng versions prior to 6.7.260717. The risk implication is significant as it facilitates unauthorized modification of the system configuration, leading to a silent failure of security monitoring infrastructure. Successful exploitation requires an attacker to possess valid low-privileged user credentials to interact with the API. There is no requirement for administrative privileges, making this an elevation of privilege scenario regarding system functionality.",
  "technicalDetails": "The root cause of this vulnerability lies in the missing implementation of server-side authorization checks within the REST v2 handlers responsible for deleting notification endpoints and recipients. In the ntopng application, REST v2 API endpoints are intended to be guarded by role-based access control (RBAC), which should restrict administrative or destructive operations to users with the 'administrator' role.\nThe vulnerable components are the specific REST v2 request handlers tasked with processing DELETE (or POST-based deletion) requests for alert notification configurations. During the architectural design or code implementation phase, these handlers failed to validate the session object or the associated user role before processing the requested modification.\nThe attack flow proceeds as follows: First, an attacker must authenticate to the ntopng web interface or API using valid, non-administrator credentials. Second, the attacker crafts a POST request targeting the specific REST v2 endpoint responsible for resource management of notification recipients and endpoints. Third, because the backend logic lacks an authorization gate, it processes the request as a privileged action. The application successfully executes the deletion command, removing all configured notification recipients and alert endpoints from the system database.\nSince the deletion is irreversible via the API in terms of immediate restoration, the post-exploitation impact is immediate silencing of all network alerts. This effectively blinds the monitoring platform, preventing the system from notifying administrators of ongoing network threats or anomalies. Because the vulnerability exists within the application's REST handler logic, it is accessible via the standard network interface used for web management. This oversight bypasses the intended security architecture, allowing a low-privileged user to perform a destructive configuration change that is normally reserved for administrative personnel.\nThe vulnerability is present in all ntopng versions prior to 6.7.260717. The exploitation behavior is straightforward and does not require complex memory corruption techniques or bypasses of memory protections, as it is a logical authorization failure."
}