CVE-2026-83621 Details

A vulnerability exists in ntopng, a web-based network traffic monitoring application, in versions prior to 6.7.260717. The issue arises in the REST API endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua, which lacks proper authorization checks. This oversight allows any authenticated user, regardless of privileges, to alter threat intelligence blacklist URLs, enable or disable blocklists, and modify update intervals. The vulnerability could be exploited to redirect threat intelligence downloads to attacker-controlled sources, disrupt scheduled updates, or disable blocklists entirely, thereby undermining the integrity and availability of ntopng's threat intelligence monitoring.

Users can update to ntopng version 6.7.260717 or later, where this vulnerability has been addressed.