CVE-2026-86091 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...

CVE-2026-86091

ntopng before 6.7.260717 fails to enforce administrator privileges in the host-pools bulk-delete REST endpoint (handled in pools_rest_utils.lua). An authenticated non-administrative user can issue POST requests to delete all host pools and their member bindings irreversibly, removing traffic poli...