Read the docs
TI-2026-58397 Aliases CVE-2026-84990

ntopng: Missing Authorization on System Configuration Backup Download and Listing

Priority HIGH 73CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-862.

Summary

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lua/rest/v2/get/system/configurations/download_backup.lua allow any authenticated non-admin user to list and download system-configuration backups without an administrator check. The download path reaches backup_config.export_backup, and prefs_dump_utils.build_prefs_dump_table includes the ntopng.user.* Redis key space in the backup. A downloaded backup can therefore disclose password hashes for local users and, when configured, API tokens, TOTP secrets, and WebAuthn credential data, enabling account compromise through usable or recoverable credentials. This issue is fixed in version 6.7.260718.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0034 27th percentileScored 2026-11-07
Fix Fixed ntopng (ntop): 6.7.260718

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ntopntopngbefore 6.7.2607186.7.260718Patch availableCNA
  • ntopng Vendorntop Affected before 6.7.260718 Fixed in 6.7.260718 Patch available CNA

Remediation

  • Fix · CNA ntopng (ntop) Fixed in 6.7.260718

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84990

References

Other 2

  • TI-2026-58894 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler CVSS 4.0HIGH 7.1
  • TI-2026-58396 ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags CVSS 3.1HIGH 7.1
  • TI-2026-85500 Stack buffer overflow in ntopng nDPI custom category detection CVSS 3.1MEDIUM 5.3
  • TI-2026-28235 ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to… CVSS 3.1CRITICAL 9.8
  • TI-2020-09603 In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer… CVSS 3.1CRITICAL 9.8
  • TI-2018-08982 An issue was discovered in ntopng 3.4 before 3.4.180617. CVSS 3.1HIGH 8.1
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences