CVE-2026-83621

Name of the Vulnerable Software and Affected Versions ntopng versions prior to 6.7.260717

Description An authentication bypass exists in the web-based network traffic monitoring application where the endpoint "/lua/rest/v2/edit/system/edit blacklist.lua" fails to verify administrator privileges before calling the lists utils.editList function. This allows any authenticated user to manipulate the list name, list enabled, url, and list update parameters. Consequently, a non-privileged user can redirect threat-intelligence downloads to malicious content, disable blocklists, or stop scheduled updates. These changes are stored in Redis and reloaded without proper authorization, compromising the integrity and availability of threat-intelligence monitoring.

Recommendations Update to version 6.7.260717.