A critical authorization flaw in ntopng versions prior to 6.7.260718 permits authenticated users to access sensitive system backups, leading to potential full account compromise.

The application fails to perform necessary capability checks on specific Lua scripts, allowing any authenticated user to list and download system configuration backups that contain sensitive Redis key data.

Successful exploitation of this vulnerability poses a severe risk to organizational security, as the exposure of password hashes, API tokens, and multi-factor authentication secrets enables complete account takeover and lateral movement. With a CVSS score of 8.8, this high-severity vulnerability represents a significant threat to the confidentiality and integrity of the network monitoring infrastructure.

Immediate Action: Update the ntopng installation to version 6.7.260718 or later to incorporate the necessary authorization checks.

Proactive Monitoring: Review web server and application access logs for unusual requests directed toward the backup configuration endpoints, specifically monitoring for non-administrative accounts accessing the listed Lua scripts.

Compensating Controls: Implement strict network access controls to limit access to the ntopng management interface to authorized personnel only, and deploy a Web Application Firewall (WAF) to block unauthorized access to the vulnerable REST API paths.

Public Exploit Available: No

Given the high CVSS score and the sensitive nature of the leaked data, organizations should prioritize patching this vulnerability immediately. Administrators must verify their ntopng version and apply the update to ensure that sensitive configuration data is shielded from unauthorized access by low-privileged users.