ntopng, a web‑based network traffic monitoring application, contains a REST API endpoint that allows any authenticated user to edit threat‑intelligence blocklists. The POST /lua/rest/v2/edit/system/edit_blacklist.lua request performs list updates without checking that the caller is an administrator, passing user supplied parameters such as list_name, list_enabled, url and list_update to lists_utils.editList. An attacker can therefore redirect blocklist downloads to malicious content, disable important blocklists or stop scheduled updates, degrading the system’s ability to detect and respond to threats. This loss of integrity and availability undermines the protective function of ntopng’s threat‑intelligence monitoring.

The flaw exists in all ntopng installations before version 6.7.260717. The vendor impacted is ntop; the product is ntopng. The vulnerability is fixed in ntopng version 6.7.260717 and newer.

The CVSS score of 8.1 classifies this issue as High; the missing authorization guard means any authenticated user, even those without admin privileges, can exploit the API. Although EPSS data is unavailable, the lack of a KEV listing does not diminish the inherent risk. An attacker needs only access to the web UI and the ability to send HTTP POST requests to the vulnerable resource. Once exploited, the attacker can permanently alter threat‑intelligence behavior and potentially expose the system to additional attacks.