CVE-2026-109356

4.3Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Authenticated users with read-only privileges can permanently delete all ports across visible devices. They need valid credentials to the web interface to issue DELETE requests to the purge endpoint.

Root cause

The PortsController::purge function fails to check for delete authorization before executing the purge request.

Affected systems

LibreNMS before 26.9.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

Upgrade LibreNMS to version 26.9.0 or later. If upgrading must wait, block DELETE requests to /ports/purge at your reverse proxy or web server.

shell

$ ./daily.sh

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase every deleted port on all visible devices.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109356