CVE-2026-111683

MEDIUM 5.4

Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks.

CWE	CWE-862
Vendor	allegro
Product	ralph
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for allegro ralph

Be the first to know when new medium vulnerabilities affecting allegro ralph are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

allegro / ralph

0 ≤ 20260902.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/ralph-dc-view-rack-api-missing-authorization github.com: https://github.com/allegro/ralph/blob/20260902.1/src/ralph/dc_view/views/api.py#L17-L96 github.com: https://github.com/allegro/ralph/blob/20260902.1/src/ralph/lib/permissions/api.py#L194-L209 github.com: https://github.com/allegro/ralph vulncheck.com: https://www.vulncheck.com/advisories/allegro-ralph-through-20260902.1-missing-authorization-in-data-center-rack-api

Credits

hieuPenguinnn