CVE-2026-86090

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-86090

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86090.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-86090

Aliases

CVE-2026-86091
GHSA-m22w-f647-vx88

Downstream

AZL-99690

Published

2026-09-04T21:48:46.991Z

Modified

2026-09-06T03:55:35.713756638Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers

Details

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.

Database specific

{
    "cwe_ids": [
        "CWE-862"
    ],
    "cna_assigner": "VulnCheck",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "6.7.260717"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "fixed": "6.7.260717"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "6.7.260717"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86090.json"
}

References

Affected packages

Git / github.com/ntop/ntopng

Affected ranges

Type

GIT

Repo

https://github.com/ntop/ntopng

Events

Introduced

Fixed

7d830f31af367745431c5d92e2e82fc432f6bdd8

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

2.*

2.4

3.*

3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86090.json"