CVE-2026-83621

Executive Summary

CVE-2026-83621 is an improper authorization vulnerability (CWE-862, Missing Authorization) in ntopng, a web-based network traffic monitoring application. Prior to version 6.7.260717, the REST endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua fails to enforce an administrator check, allowing any authenticated non-privileged user to invoke lists_utils.editList and manipulate threat-intelligence blocklist configuration. Because these changes are persisted through Redis and reloaded without a lower-level authorization guard, an attacker can redirect blocklist downloads to attacker-controlled content, disable blocklists, or prevent scheduled updates—undermining both the integrity and availability of ntopng's threat-intelligence monitoring.

Technical Analysis

The vulnerability resides in the file scripts/lua/rest/v2/edit/system/edit_blacklist.lua, which implements the REST endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua. The flaw is an authorization failure: the endpoint "lacks an administrator check" and proceeds to call lists_utils.editList for any authenticated user. The endpoint is not restricted to administrative principals, so a user holding only a standard authenticated session (represented in the CVSS vector by PR:L — Low privileges required) can reach and execute the privileged operation.

The operation accepts four parameters named in the advisory: list_name, list_enabled, url, and list_update. These parameters control the identity of the blocklist, whether it is enabled, the source URL from which threat-intelligence content is downloaded, and the update behavior of the list. Because authorization is missing at the endpoint level, a non-admin user can supply these parameters to perform privileged configuration changes.

The downstream handler lists_utils.editList is described as performing the actual list modification without a secondary or lower-level authorization guard. Consequently, the missing check at the endpoint is not compensated by any check further down the call path—there is no defense in depth. The advisory further states that the resulting changes "are persisted through Redis and reloaded" without a lower-level authorization guard. This means the attacker's configuration modification survives beyond the immediate request: it is stored in the Redis backing store and re-applied when the application reloads the list configuration, giving the change persistence and durability.

Broader context: per the NVD description, the referenced ntopng version and file (scripts/lua/rest/v2/edit/system/edit_blacklist.lua, endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua) and version threshold (prior to 6.7.260717) are the only concrete technical details available. No public proof-of-concept, exploit code, or Nuclei template exists per the provided data, and no further code-level specifics (function internals, exact Redis keys, or session handling) are disclosed. Analysis beyond the described mechanism would be speculative.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-862, Missing Authorization) and the exact details provided in the NVD description. Per the strict rules, only parameter names and file/endpoint identifiers that appear verbatim in the advisory are used; no additional implementation details are invented.

1. Reconnaissance / target identification. An attacker identifies an internet-exposed or reachable ntopng instance running a version prior to 6.7.260717. The attacker must hold valid credentials for a non-privileged ("non-admin") authenticated account—consistent with the CVSS PR:L (Low privileges required), AV:N (Network) metrics. Access to the web interface or REST layer is required, but no administrative role is needed.

2. Triggering the specific flaw class. The vulnerability class is Missing Authorization. The attacker issues an authenticated POST request to /lua/rest/v2/edit/system/edit_blacklist.lua. Because the endpoint "lacks an administrator check," the request is processed for any authenticated user rather than being rejected for lack of the required role. This is the core of CWE-862: a privileged action is reachable by a principal that should not be authorized to perform it.

3. Payload / execution at the vulnerability-class level. Within the same request, the attacker supplies the exposed parameters list_name, list_enabled, url, and list_update. Through these parameters the attacker can, per the advisory: (a) set the url to redirect a threat-intelligence download to attacker-controlled content, (b) use list_enabled (and/or list_name) to disable blocklists, and (c) use list_update to prevent scheduled updates. The request is then passed to lists_utils.editList, which—lacking a lower-level authorization guard—applies the change. No detailed payload string is specified in the advisory, so no fabricated payload is presented here.

4. Post-exploitation impact. The modified configuration is persisted through Redis and reloaded without a lower-level authorization guard, so the attacker's change takes effect and persists across reloads. The net result is that the integrity of the threat-intelligence dataset is corrupted (blocklists may point to attacker-controlled sources) and the availability of monitoring is degraded (blocklists disabled or no longer updated). This maps directly to the CVSS impacts I:H (High integrity) and A:H (High availability) with C:N (no confidentiality impact).

Impact Assessment

CVE-2026-83621 carries a CVSS v3.1 base score of 8.1 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. The subscores are:

• Attack Vector (AV:N — Network): The endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua is network-reachable via the ntopng web interface/REST layer.
• Attack Complexity (AC:L — Low): No special conditions are required; the endpoint processes the request directly for any authenticated user.
• Privileges Required (PR:L — Low): The attacker needs only a valid non-admin authenticated account, not administrative rights.
• User Interaction (UI:N — None): No victim action is required; the attacker acts directly.
• Scope (S:U — Unchanged): Impact remains within the same security authority.
• Confidentiality (C:N — None): No confidentiality impact is described.
• Integrity (I:H — High): The attacker can alter blocklist contents and redirect downloads to attacker-controlled content, corrupting the integrity of the threat-intelligence function.
• Availability (A:H — High): The attacker can disable blocklists and prevent scheduled updates, degrading the monitoring function's availability.

Business impact. ntopng is commonly deployed as a network traffic monitoring and security telemetry component. Corruption of its threat-intelligence blocklists can silently degrade an organization's detection coverage: blocklists that should match known-bad indicators may be replaced, disabled, or allowed to go stale. The persistence via Redis means the effect is not transient—it survives reloads and may go unnoticed. Because the manipulation is performed through a legitimate, authenticated API call, the activity may blend into normal administrative traffic, complicating detection.

Blast radius. Impact is scoped to the individual ntopng deployment (CVSS S:U); however, the downstream effect is that any detection, alerting, or enforcement that relies on ntopng's threat-intelligence lists may be weakened for the duration of the manipulation. No evidence of exploit-in-the-wild, no CISA KEV listing, and no EPSS score (not yet scored by FIRST.org) were provided at the time of this report.

Detection Guidance

Sigma Rule

title: ntopng Unauthorized Blocklist Modification via edit_blacklist.lua
id: 7f3c2a10-8b41-4c9e-9a2d-ntopng83621
status: experimental
description: Detects non-admin or anomalous access to the ntopng REST endpoint that edits threat-intelligence blocklists, indicative of CVE-2026-83621 (CWE-862 missing authorization).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-83621
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: ntopng
detection:
  selection_uri:
    cs-uri-stem|endswith: '/lua/rest/v2/edit/system/edit_blacklist.lua'
  selection_method:
    cs-method: 'POST'
  selection_params:
    cs-uri-query|contains:
      - 'list_name'
      - 'list_enabled'
      - 'url'
      - 'list_update'
  condition: selection_method and (selection_uri or selection_params)
falsepositives:
  - Legitimate administrator blocklist configuration changes
level: high
tags:
  - attack.t1190

YARA Rule

rule CVE_2026_83621_ntopng_edit_blacklist
{
    meta:
        description = "Detects references to the vulnerable ntopng blocklist edit endpoint and handler"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-83621"
        cve = "CVE-2026-83621"
        date = "2026-01-01"

    strings:
        $ep  = "/lua/rest/v2/edit/system/edit_blacklist.lua" ascii wide
        $fn  = "edit_blacklist.lua" ascii wide
        $lst = "lists_utils.editList" ascii wide
        $p1  = "list_name" ascii wide
        $p2  = "list_enabled" ascii wide
        $p3  = "list_update" ascii wide

    condition:
        any of ($ep, $fn) and any of ($lst, $p1, $p2, $p3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-83621 ntopng Unauthorized Blocklist Edit Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/lua/rest/v2/edit/system/edit_blacklist.lua"; http.uri; content:"list_name"; http.uri; content:"url"; classtype:attempted-admin; reference:cve,2026-83621; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-83621; sid:202683621; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "POST" and
      endsWith(http.request.uri.path, "/lua/rest/v2/edit/system/edit_blacklist.lua") ]
  [ network where endsWith(http.request.uri.path, "/lua/rest/v2/edit/system/edit_blacklist.lua") and
      (stringContains(http.request.uri.query, "list_name") or
       stringContains(http.request.uri.query, "list_enabled") or
       stringContains(http.request.uri.query, "url") or
       stringContains(http.request.uri.query, "list_update")) ]

Splunk SPL Query

index=web OR index=ntopng
| search uri_path="/lua/rest/v2/edit/system/edit_blacklist.lua" method="POST"
| eval suspicious_param=if(match(uri_query,"(?i)(list_name|list_enabled|url|list_update)"),"yes","no")
| stats count values(uri_query) as query_values values(suspicious_param) as param_flag
        by src_ip user
| where count > 0
| table src_ip user count param_flag query_values

Wazuh OSSEC Rule

<group name="ntopng,web,">
  <rule id="100836" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/lua/rest/v2/edit/system/edit_blacklist\.lua</field>
    <field name="method">POST</field>
    <description>CVE-2026-83621: Possible unauthorized ntopng blocklist modification via edit_blacklist.lua</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_83621,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The advisory states the issue "is fixed in version 6.7.260717," but no vendor patch reference, commit, or advisory URL evidence is available in the provided data. Treat current deployments as vulnerable until verified.

1. Immediate mitigations

   • Upgrade to ntopng version 6.7.260717 or later, per the NVD description's stated fix version. Verify the installed version after upgrading.
   • Restrict network access to the ntopng web/REST interface to trusted management networks only; do not expose POST /lua/rest/v2/edit/system/edit_blacklist.lua to untrusted users.
   • Audit and minimize accounts that can authenticate to ntopng; because the flaw is a missing authorization check, removing or restricting non-admin authenticated access reduces the exposed attack surface.
   • Review blocklist/source configuration for unauthorized url values, disabled lists, or suspended updates, since changes persist via Redis and survive reloads.

2. Patch / upgrade steps

   • Apply the fix by moving to version 6.7.260717 as documented. Because patch confidence is 0/4 and no patch source evidence is available, confirm the release notes for that version explicitly reference this endpoint fix before relying on it.
   • After upgrading, re-validate blocklist configuration (list sources, enabled state, and update schedule) to confirm no attacker-introduced changes remain persisted in Redis.

3. Long-term hardening

   • Enforce role-based access control centrally so that privileged REST endpoints—including edit_blacklist.lua—require an explicit administrator role check at the endpoint layer, and add defense-in-depth authorization at the lists_utils.editList layer.
   • Log and alert on all modifications to threat-intelligence blocklist configuration, and treat non-admin access attempts to administrative endpoints as high-severity events.
   • Adopt a hardening baseline for ntopng deployments: authenticated-only access, least-privilege accounts, and monitoring for changes to list url values.

References

• NVD — CVE-2026-83621: https://nvd.nist.gov/vuln/detail/CVE-2026-83621
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• ntopng project documentation and release notes (verify the 6.7.260717 fix for scripts/lua/rest/v2/edit/system/edit_blacklist.lua): https://www.ntop.org/
• CISA Known Exploited Vulnerabilities (KEV) catalog — status: NOT listed (verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data. No public PoC or exploit code is known at the time of this report.