EUVD-2026-97658
GHSA-h6hv-5g7p-j2pv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with read-only account
-
ExploitSend DELETE request to /ports/purge
-
ExecutionSubmit purge=all parameter
-
ImpactIrreversibly erase deleted ports on all visible devices
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated LibreNMS account with global-read (read-only) privileges running a version before 26.9.0; the attacker issues a DELETE request to /ports/purge and can use purge=all to erase all deleted ports on every visible device. Limiting factors: authentication is mandatory (PR:L, not anonymous), no user interaction is needed, and impact is confined to already soft-deleted port records (physical/irreversible purge) rather than live configuration - meaning exploitation is an abuse of an existing low-privilege account rather than a fully unauthenticated remote attack. |
| Impact | This is a moderate, authenticated access-control flaw (CWE-862 Missing Authorization) rather than a high-urgency issue. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) scores 5.3 and is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated low-privilege account (PR:L) and yielding only limited integrity impact (VI:L) with no confidentiality or availability loss. No EPSS score, no CISA KEV listing, and no POC were provided in the intelligence set, so there is no public signal of active exploitation or exploit-code availability - the risk is primarily insider/abuse-of-access and post-compromise privilege misuse, not mass opportunistic exploitation. The main caveat is that the impact of irreversibly purging port records arguably has an availability/data-loss dimension that the official vector encodes only as integrity (VI:L); defenders concerned about monitoring-data destruction should weigh that. Overall: a real but lower-tier priority - patch in normal cycles, prioritize if untrusted users hold read-only LibreNMS accounts. |
| Exploit ScenarioDerived | A user granted only a global-read (read-only) LibreNMS account - or an attacker who has compromised such an account - sends a DELETE request to /ports/purge with the parameter purge=all. Despite lacking delete privileges, the request succeeds and irreversibly erases every soft-deleted port across all devices the account can see. No public exploit code was identified in the provided data, but the attack is a trivial authenticated HTTP request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Missing authorization in LibreNMS before 26.9.0 allows any authenticated account holding the global-read (read-only) role to permanently purge port records it has no delete rights over. By issuing a DELETE request to /ports/purge - optionally with purge=all - a low-privilege user can irreversibly erase every soft-deleted port across all devices visible to that account. The flaw is an authenticated privilege-escalation-style access-control gap (CVSS 3.1 5.3, PR:L) with integrity-only impact confined to already soft-deleted port entries; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV). The vendor-released patch is LibreNMS 26.9.0.
RemediationAI
Vendor-released patch: upgrade LibreNMS to 26.9.0 or later, which adds the missing authorization check to PortsController::purge - see https://github.com/librenms/librenms/security/advisories/GHSA-9qcg-rgg9-mpjg for the official guidance. If immediate upgrading is not possible, apply compensating controls with awareness of their trade-offs: block or reject HTTP DELETE requests to /ports/purge at a reverse proxy, WAF, or web server layer for client IP ranges associated with read-only/NOC accounts (this is a coarse control, as the proxy generally cannot evaluate LibreNMS roles, and it may also block legitimate administrative purges); temporarily remove or restrict the global-read role from accounts that do not strictly need it until patched (side effect: those users lose legitimate read-only monitoring visibility); and restrict network access to the LibreNMS web interface so that only trusted management networks can reach it. Because deletion is irreversible, also review audit logs for any prior DELETE calls to /ports/purge from global-read accounts and record which port data was lost. Vulnerability intelligence tagged the issue as an authentication-bypass-class access-control defect, so any interim role or endpoint filtering should be validated after the 26.9.0 upgrade and then removed in favour of the upstream fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LibreNMS is a PHP/MySQL network monitoring and management platform, and CVE-2026-109356 is classified as CWE-862 (Missing Authorization). The root cause is that PortsController::purge performs its destructive action without enforcing the delete-privilege authorization check that the application's role model requires; role checking is effectively bypassed for users holding the global-read permission set. Ports in LibreNMS are normally soft-deleted (retained as recoverable records), and the purge routine is the mechanism that physically and irreversibly removes them - so this vulnerability converts a routine read-only account into a destructive actor against the deleted-port history of every device that account can see. The endpoint is reachable over the network as an ordinary HTTP DELETE to /ports/purge, and the purge=all parameter widens the blast radius from a single record to all deleted ports on all visible devices. The affected CPE range is cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*, i.e. all LibreNMS releases prior to the 26.9.0 fix. There is no requirement for user interaction (UI:N) and no confidentiality or availability impact - the entire consequence is an integrity violation against deleted port inventory data, which is why the assessed base score is a moderate 5.3.
Know when Librenms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable HTTP endpoint (AV:N/AC:L), but requires an authenticated read-only account (PR:L); unauthorized deletion of records is an integrity loss (I:L) with no confidentiality and no service-availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase every deleted port on all visible devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An issue was discovered in LibreNMS through 1.47. Rated high severity (CVSS 7.2), this vulnerability is remotely exploit
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php. Rate
An issue was discovered in LibreNMS through 1.47. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
Authentication bypass in the LibreNMS REST API (all versions before 26.8.0) lets unauthenticated remote attackers reach
SQL injection in LibreNMS 25.12.0 and below. PoC and patch available.
An issue was discovered in LibreNMS through 1.47. Rated critical severity (CVSS 9.1), this vulnerability is remotely exp
SQL injection in LibreNMS versions 25.12.0 and below allows authenticated users to extract sensitive database informatio
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated high severity (CVSS 8.8), this vulnera
An issue was discovered in LibreNMS before 1.65.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
An issue was discovered in LibreNMS 1.50.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
An issue was discovered in LibreNMS through 1.47. Rated high severity (CVSS 8.8), this vulnerability is remotely exploit
Command injection in LibreNMS's Virtualization Discovery module enables authenticated administrator-level users to execu
Exploit-DB