CVE-2026-86091

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-86091

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86091.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-86091

Aliases

CVE-2026-86090
GHSA-m22w-f647-vx88

Downstream

AZL-99693

Published

2026-09-04T21:48:47.663Z

Modified

2026-09-06T03:55:35.713756638Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler

Details

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.

Database specific

{
    "cwe_ids": [
        "CWE-862"
    ],
    "cna_assigner": "VulnCheck",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "6.7.260717"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "fixed": "6.7.260717"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "6.7.260717"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86091.json"
}

References

Affected packages

Git / github.com/ntop/ntopng

Affected ranges

Type

GIT

Repo

https://github.com/ntop/ntopng

Events

Introduced

Fixed

7d830f31af367745431c5d92e2e82fc432f6bdd8

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

2.*

2.4

3.*

3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86091.json"