Description

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-04T22:17:18.990Z",
  "pubdate": "2026-09-04T22:17:18.990Z",
  "executiveSummary": "ntopng versions prior to 6.7.260717 are susceptible to an Insecure Direct Object Reference (IDOR) and broken access control vulnerability within the pools bulk-delete endpoint.\nThis security flaw allows authenticated non-administrative users to trigger the destruction of all host pools and associated member bindings.\nThe vulnerability poses a significant risk to organizational security posture, as the removal of host pools invalidates traffic policy bindings and bypasses established visibility restrictions.\nAn attacker with standard user credentials can execute this operation by crafting a specific POST request directed at the affected endpoint.\nThe impact is destructive and irreversible, potentially leading to unauthorized data exposure or the collapse of network monitoring governance by stripping away existing security enforcement layers.\nThis vulnerability highlights a critical failure in server-side authorization checks for administrative API functions.",
  "technicalDetails": "The vulnerability resides in the request handling logic of the ntopng host pools management interface. Specifically, the bulk-delete functionality fails to validate the authorization level of the requesting user against the administrative requirements necessary to perform destructive configuration changes.\nThe root cause is a deficiency in the privilege validation layer, which assumes that incoming requests to the bulk-delete endpoint originate from a session with administrative context. Because the backend does not enforce a role-based access control (RBAC) check prior to executing the deletion command, any authenticated user—regardless of their assigned role—can interact with the endpoint.\nThe attack flow involves an authenticated attacker interacting with the application via the pools management API. Upon identifying the POST endpoint associated with pool deletion, the attacker crafts a malicious request. Because the server-side code performs no verification of the user's administrative status, the application proceeds to execute the logic responsible for purging entries from the pool database.\nThe technical impact is systemic: ntopng utilizes host pools to categorize traffic and apply granular security policies, such as visibility restrictions and data retention/analysis rules. By invoking this endpoint, an attacker forces the application to remove all defined pools and the associated member bindings. This results in the immediate loss of all traffic segmentation policies defined within the application.\nAffected versions include all iterations of ntopng prior to 6.7.260717. The exposure is limited to authenticated environments, as the application requires a valid session token, though this effectively lowers the barrier to entry for an insider threat or an attacker who has compromised a low-privileged account.\nThe exploitation does not require advanced technical sophistication; it merely requires the attacker to submit a valid HTTP POST request to the target URI. The resulting payload processing triggers a backend function that iterates through all existing pools, clearing them from memory and the underlying configuration storage. Once processed, the administrative interface reflects a global state of policy vacancy, effectively disabling security controls and monitoring restrictions that were contingent on those pool assignments."
}