CVE-2026-111683: Missing Authorization in allegro ralph
Description
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks.
CVSS v4.0
Score 5.3medium
Affected software
allegro
ralph
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Allegro Ralph versions up to and including 20260902.1 contain a missing authorization vulnerability where the RalphPermission mechanism does not enforce permission checks on views lacking a queryset. Authenticated staff users can exploit this by accessing the DCAssetsView and SRRacksAPIView endpoints at /api/rack/<id> and /api/server_room/<id>. This bypass enables reading of asset hostnames, serial numbers, and management IP addresses, as well as the ability to modify, move, or create rack resources without proper authorization.
Potential Impact
The vulnerability allows authenticated staff users to bypass intended rack model permissions, leading to unauthorized disclosure of sensitive asset information and unauthorized modification of rack data. This could result in exposure of hostnames, serial numbers, and management IPs, and unauthorized changes to rack configurations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict staff user permissions where possible and monitor access to the affected API endpoints to limit exploitation risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-16T14:31:19.375Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad264172cdf04f656199b14
Added to database: 10/16/2026, 17:51:19 UTC
Last enriched: 10/16/2026, 18:19:01 UTC
Last updated: 10/16/2026, 23:10:55 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.