CVE-2026-83621

8.1 HIGHpublic exploit available

Published 2026-09-21 · Updated 2026-09-23

AI risk analysis

Summary: The flaw allows non-admin users to modify system settings, including threat-intelligence blocklists, potentially leading to unauthorized content access and disruption of monitoring.
Exploitability: Exploitation requires an authenticated user with write access to the specified endpoint. Precondition is the presence of a non-admin user with network access.
Blast radius: If exploited, the impact could be significant, affecting the integrity and availability of threat-intelligence monitoring for the entire organization.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to version 6.7.260717 or later.

auth-bypasswebconfigurationmonitoring

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scripts/lua/rest/v2/edit/system/edit_blacklist.lua lacks an administrator check and calls lists_utils.editList for any authenticated user. The list_name, list_enabled, url, and list_update parameters allow a non-admin user to redirect threat-intelligence downloads to attacker-controlled content, disable blocklists, or prevent scheduled updates. The changes are persisted through Redis and reloaded without a lower-level authorization guard, undermining the integrity and availability of ntopng's threat-intelligence monitoring. This issue is fixed in version 6.7.260717.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE-862

Public exploit & PoC references

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.