Description
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.
References7
- github.com/ntop/ntopng
- github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649e…
- github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649e…
- github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc43…
- github.com/ntop/ntopng/security/advisories/GHSA-m22w-f647-vx88
- www.vulncheck.com/advisories/ntopng-before-6.7.260717-missing-a…
- github.com/ntop/ntopng/security/advisories/GHSA-m22w-f647-vx88
Metrics
- CVSS 3.1
-
7.1
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L - CVSS 4.0
-
7.1
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 44 · as of 7 November 2026
- CWE
- CWE-862
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.