---
cve: "CVE-2026-86091"
severity: "HIGH"
cvss: 7.1
epss: "0.3%"
vendor: "ntop"
kev: false
exploited: false
published: "2026-09-04 22:17:18"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-23T00:39:53+02:00"
---

# CVE-2026-86091

> 7.1 HIGH · 🧪 PoC

## Beschreibung

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |

## Patch verfügbar (OSV)

- 7d830f31af367745431c5d92e2e82fc432f6bdd8 (Commit)

## Referenzen

- <https://github.com/ntop/ntopng/security/advisories/GHSA-m22w-f647-vx88>
- <https://github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc432f6bdd8>
- <https://github.com/ntop/ntopng>
- <https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/rest/v2/delete/pools.lua>
- <https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/modules/pools/pools_rest_utils.lua>
- <https://www.vulncheck.com/advisories/ntopng-before-6.7.260717-missing-authorization-on-the-host-pool-bulk-delete-handler>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-86091) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_