ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag.lua` — perform no authorization check at all. Any authenticated user, including a non-administrator ("unprivileged") account, can delete or rename any tag in the system, including tags created by an administrator. Version 6.7.260718 contains a fix.

ntopng, a web-based network traffic monitoring application, contains a missing authorization vulnerability in versions 6.7.0 through 6.7.260717. Two REST v2 API endpoints responsible for managing tags/badges — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization checks whatsoever. Any authenticated user, even one with unprivileged/non-administrator access, can exploit these endpoints to delete or rename any tag in the system, including those created by administrators. This represents a broken access control issue where privilege separation is not enforced at the API level. The vulnerability has been patched in version 6.7.260718. Users of affected versions are advised to upgrade immediately to remediate the risk.