CVE-2026-109356

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.0

Description An authorization flaw exists in the PortsController::purge function. Users with global-read permissions can bypass authorization to physically delete ports without having the required delete privileges. An attacker with a read-only account can send a DELETE request to the '/ports/purge' endpoint using the purge variable set to 'all' to irreversibly erase every deleted port across all visible devices.

Recommendations Update LibreNMS to version 26.9.0 or later. As a temporary mitigation, restrict access to the '/ports/purge' endpoint for users with read-only permissions.