CVE-2026-84989

Name of the Vulnerable Software and Affected Versions ntopng versions 6.7.0 through 6.7.260717

Description Two REST v2 endpoints used to manage the tag/badge feature lack authorization checks. This allows any authenticated user, including those with unprivileged accounts, to delete or rename any tag in the system, regardless of whether the tag was created by an administrator. The affected endpoints are POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua.

Recommendations Update to version 6.7.260718.