CVE-2026-86090 ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers
Authenticated non-admin users can delete notification endpoints and recipients in ntopng, silencing alerts and disrupting monitoring.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-86090?
CVE-2026-86090 is a high-severity missing authorization vulnerability in ntopng, published on 4 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.
Weakness: CWE-862
Which versions are affected by CVE-2026-86090?
How do I fix CVE-2026-86090?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-86090 being exploited?
There is no known exploitation of CVE-2026-86090 in the wild and no public exploit code.
Sources
Also known as AZL-99690, GHSA-jh82-5ccp-7w4v, UBUNTU-CVE-2026-86090.