A missing authorization vulnerability in ntopng allows any authenticated user to disable security blocklists or redirect threat intelligence feeds, posing a significant risk to network integrity.

The application fails to perform an administrator capability check when accessing the edit_blacklist.lua endpoint, allowing low-privileged authenticated users to modify system-level security configurations.

Successful exploitation allows an attacker to effectively blind the network monitoring system by disabling blocklists or injecting malicious intelligence sources. Given the CVSS score of 8.1, this high-severity flaw threatens the operational security of the entire network, potentially allowing malicious traffic to bypass detection mechanisms and remain persistent within the environment.

Immediate Action: Upgrade ntopng to version 6.7.260717 or later to implement the mandatory administrative authorization checks.

Proactive Monitoring: Review application access logs for unusual requests to the /lua/rest/v2/edit/system/edit_blacklist.lua endpoint, particularly those originating from non-administrative user accounts.

Compensating Controls: Restrict access to the ntopng web interface to trusted management networks and enforce strict multi-factor authentication for all user accounts to minimize the risk of unauthorized access.

Public Exploit Available: No

This vulnerability represents a critical failure in access control that permits unauthorized modification of security-critical settings. Organizations utilizing ntopng must prioritize the update to version 6.7.260717 immediately to prevent potential network reconnaissance or malicious traffic bypasses facilitated by this authorization oversight.