EUVD-2026-83983Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network REST endpoint callable by any authenticated non-admin (PR:L), no interaction; tampering/disabling blocklists yields high integrity and availability impact but no data disclosure (C:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scripts/lua/rest/v2/edit/system/edit_blacklist.lua lacks an administrator check and calls lists_utils.editList for any authenticated user. The list_name, list_enabled, url, and list_update parameters allow a non-admin user to redirect threat-intelligence downloads to attacker-controlled content, disable blocklists, or prevent scheduled updates. The changes are persisted through Redis and reloaded without a lower-level authorization guard, undermining the integrity and availability of ntopng's threat-intelligence monitoring. This issue is fixed in version 6.7.260717.
Articles & Coverage 1
AnalysisAI
Any authenticated but non-administrator user on ntopng deployments prior to 6.7.260717 can tamper with threat-intelligence blocklists through the REST endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua, which performed no administrator check before invoking lists_utils.editList. By manipulating the list_name, list_enabled, url, and list_update parameters, a low-privileged account can repoint blocklist downloads to attacker-controlled content, disable existing blocklists, or suppress scheduled updates, with the changes persisted in Redis and reloaded without a lower-level authorization guard. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid but non-administrator authenticated ntopng user account (PR:L) able to reach the web REST API; the vulnerable endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua performed no administrator check before calling lists_utils.editList. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H = 8.1 High) is internally consistent with the description and the confirming commit: a network-reachable REST endpoint reachable by any low-privileged authenticated user (PR:L), no interaction, with high integrity and availability impact but zero confidentiality impact - appropriate for a missing-authorization (CWE-862) flaw that tampers with security controls rather than leaking data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade ntopng to 6.7.260717 or later, which introduces the missing isAdministrator() gate in scripts/lua/rest/v2/edit/system/edit_blacklist.lua and returns not_granted to non-administrative callers (see https://github.com/ntop/ntopng/security/advisories/GHSA-ffg5-889g-f5q8 and the fix commits https://github.com/ntop/ntopng/commit/1d0627d802c59130c82478a4eb7f14014064eae5 and https://github.com/ntop/ntopng/commit/669589fe208fc932fe40a840e0de8e4d9df6023f). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every ntopng instance and identify those running a version prior to 6.7.260717, enumerate all non-administrator accounts on each deployment, and block or remove direct access to the REST endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua for non-administrator users (via reverse-proxy rules, network segmentation, or by suspending non-admin accounts until remediation), while reviewing the Redis-persisted blocklist configuration for unauthorized list_name, url, list_enabled, or list_update values and rotating credentials for any low-privileged accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 throu
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today