ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.

CVE-2026-86090 affects ntopng versions before 6.7.260717, where the application fails to enforce authorization checks in the REST v2 API delete handlers for notification endpoints and recipients. Authenticated non-administrator users can exploit this flaw by issuing POST requests to irreversibly delete all configured notification endpoints and recipients. This effectively silences all alerts generated by the network monitoring platform, potentially blinding administrators to ongoing incidents. The vulnerability is classified as a missing authorization (broken access control) issue. A fix was introduced in ntopng version 6.7.260717. The issue is documented in a GitHub security advisory (GHSA-m22w-f647-vx88) and the relevant fix commit is available. The affected Lua scripts are endpoints.lua and recipients.lua in the REST v2 delete handlers. VulnCheck has also published an advisory covering this vulnerability.