CVE-2026-84989

HighCVSS 7.1/10Last modified Sep 9, 2026

Description

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag.lua` — perform no authorization check at all. Any authenticated user, including a non-administrator ("unprivileged") account, can delete or rename any tag in the system, including tags created by an administrator. Version 6.7.260718 contains a fix.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
ntop	ntopng	>= 6.7.0, < 6.7.260718

References

Timeline

Published: Sep 3, 2026
Last modified: Sep 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-84995.3The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in versions up to, and inc CVE-2026-849908.8ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_availa CVE-2026-849926.1md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback CVE-2026-849936.5MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 and 7.1.7, the shared CVE-2026-849948.7Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side q CVE-2026-849977.5react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedD CVE-2026-849999.8The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 v CVE-2026-85009.8Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is a small CGI application for managing htpasswd files using t CVE-2026-850005.3The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a s CVE-2026-850016.8The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an CVE-2026-850026.8The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, whi CVE-2026-850044.3The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying