EUVD-2026-83984Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated non-admin over the network (PR:L, AV:N, AC:L) reads a config backup; direct impact is confidentiality of credentials only, so I:N/A:N - account takeover is a downstream consequence.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lua/rest/v2/get/system/configurations/download_backup.lua allow any authenticated non-admin user to list and download system-configuration backups without an administrator check. The download path reaches backup_config.export_backup, and prefs_dump_utils.build_prefs_dump_table includes the ntopng.user.* Redis key space in the backup. A downloaded backup can therefore disclose password hashes for local users and, when configured, API tokens, TOTP secrets, and WebAuthn credential data, enabling account compromise through usable or recoverable credentials. This issue is fixed in version 6.7.260718.
Articles & Coverage 1
AnalysisAI
Authenticated non-administrator users of ntopng prior to 6.7.260718 can list and download complete system-configuration backups through the REST v2 endpoints get/system/configurations/list_available_backups.lua and download_backup.lua, which lack the administrator authorization check that the vendor's fix adds. Because the backup payload includes the ntopng.user.* Redis key space, the downloaded archive routinely discloses local-user password hashes and, on deployments where those features are configured, API tokens, TOTP secrets and WebAuthn credential material - enabling account takeover via usable or crackable credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated non-administrator ntopng account (PR:L) with network reachability to the web interface; no user interaction and no non-default configuration are needed to trigger the flaw, as the missing admin check affects the backup endpoints in default builds prior to 6.7.260718. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, actionable priority for any multi-user ntopng deployment, though the vendor CVSS of 8.8 slightly overstates the direct technical impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ntopng to 6.7.260718 or later - this is a vendor-released patch and the definitive fix, applying the isAdministratorOrPrintErr() administrator check to both list_available_backups.lua and download_backup.lua (see GHSA-7gqc-vjwr-6rh5 and commit f912ee93bc143330b6ff3bb946ee7211e5ee9e1a). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which ntopng instances run versions prior to 6.7.260718 and treat them as credential-exposed; block or deny access to the REST v2 endpoints get/system/configurations/list_available_backups.lua and download_backup.lua at the reverse proxy, WAF or firewall layer (or disable the configuration-backup/restore feature where it is not operationally required), and audit REST v2 access logs for any calls to those two endpoints by non-administrator accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 throu
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today