CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated non-administrator users in ntopng versions prior to 6.7.260717 to bypass authorization checks on delete endpoints, enabling them to issue POST requests that can irreversibly delete all notification endpoints and recipients. This results in the silencing of all alerts, potentially leading to undetected system issues. Organizations using ntopng should prioritize patching this vulnerability to prevent unauthorized data loss and ensure alert functionality remains intact.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.