The vulnerability is a missing authorization check in LibreNMS’s PortsController::purge method. Users who have only read access can send HTTP DELETE requests to the /ports/purge endpoint with the parameter purge=all. This remotely removes every deleted port from all devices the user can view, effectively enabling destructive data deletion without any delete permissions. The flaw is a classic missing authorization weakness, classified as CWE-862.

LibreNMS versions prior to 26.9.0 are affected. The flaw applies to all builds of the LibreNMS platform that use the PortsController::purge functionality before the patch citing version 26.9.0 and later.

The Common Vulnerability Scoring System assigns the issue a score of 5.3, indicating a moderate severity. There is no publicly available EPSS value, and the vulnerability is not listed in the CISA KEV catalog. Attackers who control a read-only account can exploit the flaw by crafting a DELETE request to /ports/purge with purge=all, which the vulnerable system processes without verifying proper privileges. Because the endpoint is accessible over the network, the attack can be performed remotely and does not require elevated privileges beyond those of a read-only user.