CVE-2026-84990

Name of the Vulnerable Software and Affected Versions ntopng versions prior to 6.7.260718

Description Authenticated non-administrator users can list and download system-configuration backups due to a missing administrator check in the endpoints 'scripts/lua/rest/v2/get/system/configurations/list available backups.lua' and 'scripts/lua/rest/v2/get/system/configurations/download backup.lua'. The process involves the backup config.export backup path and the prefs dump utils.build prefs dump table function, which includes the ntopng.user.* Redis key space. This can lead to the disclosure of local user password hashes, API tokens, TOTP secrets, and WebAuthn credential data, potentially allowing account compromise.

Recommendations Update to version 6.7.260718.