CVE-2026-83621

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scripts/lua/rest/v2/edit/system/edit_blacklist.lua lacks an administrator check and calls lists_utils.editList for any authenticated user. The list_name, list_enabled, url, and list_update parameters allow a non-admin user to redirect threat-intelligence downloads to attacker-controlled content, disable blocklists, or prevent scheduled updates. The changes are persisted through Redis and reloaded without a lower-level authorization guard, undermining the integrity and availability of ntopng's threat-intelligence monitoring. This issue is fixed in version 6.7.260717.

• CWE-862

• https://github.com/ntop/ntopng/commit/1d0627d802c59130c82478a4eb7f14014064eae5
• https://github.com/ntop/ntopng/commit/669589fe208fc932fe40a840e0de8e4d9df6023f
• https://github.com/ntop/ntopng/security/advisories/GHSA-ffg5-889g-f5q8

Published

Sep 21, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-83615xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…8.7
• CVE-2026-83616xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…8.7
• CVE-2026-83617xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…8.7
• CVE-2026-83618xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…8.7
• CVE-2026-83619xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…8.7
• CVE-2026-8362A stack-based buffer overflow condition exists in WOSDefault…9.8
• CVE-2026-83625The Contact Form by Supsystic plugin for WordPress is vulner…7.2
• CVE-2026-83627The Hummingbird – Speed Optimization, Caching, Minify, Compr…9.8
• CVE-2026-83628The Theme My Login plugin for WordPress is vulnerable to Mis…4.3
• CVE-2026-8363A stack-based buffer overflow condition exists in WOSDeviceD…9.8
• CVE-2026-8364Gladinet Triofox Cloud Server Agent Access Service (GladServ…9.8
• CVE-2026-8365The Blocksy theme for WordPress is vulnerable to PHP Object …8.8