{"id":"CVE-2026-84989","title":"ntopng is a web-based network traffic monitoring application","summary":"ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cwe":["CWE-862"],"published":"2026-09-03","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84989","references":[{"url":"https://github.com/ntop/ntopng/commit/0e41f24b367fb9caf750459da67827326e3289e8","label":"security-advisories@github.com"},{"url":"https://github.com/ntop/ntopng/security/advisories/GHSA-43p9-5758-wwq8","label":"security-advisories@github.com"},{"url":"https://github.com/ntop/ntopng/security/advisories/GHSA-43p9-5758-wwq8","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.0022,"epssPercentile":0.12758,"ingestedAt":"2026-09-09T21:22:45.565Z","slug":"CVE-2026-84989","body":"## Overview\n\nntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag.lua` — perform no authorization check at all. Any authenticated user, including a non-administrator (\"unprivileged\") account, can delete or rename any tag in the system, including tags created by an administrator. Version 6.7.260718 contains a fix.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}