{"id":"CVE-2026-111683","summary":"Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API","details":"Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/\u003cid\u003e and /api/server_room/\u003cid\u003e to read asset hostnames, serials and management IPs, and to modify, move or create racks.","modified":"2026-10-21T02:55:49.249343593Z","published":"2026-10-16T17:39:40.888Z","database_specific":{"cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111683.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111683.json"},{"type":"PACKAGE","url":"https://github.com/allegro/ralph"},{"type":"ARTICLE","url":"https://github.com/allegro/ralph/blob/20260902.1/src/ralph/dc_view/views/api.py#L17-L96"},{"type":"ARTICLE","url":"https://github.com/allegro/ralph/blob/20260902.1/src/ralph/lib/permissions/api.py#L194-L209"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/ralph-dc-view-rack-api-missing-authorization"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111683"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/allegro-ralph-through-20260902.1-missing-authorization-in-data-center-rack-api"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/allegro/ralph","events":[{"introduced":"0"},{"last_affected":"adbe619caba31425a6b28bd8913fed2500c2fd96"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"20260902.1"}]}]}}],"versions":["20260902.1","20260831.2","20260831.1","20260819.1","20260817.1","20260813.2","20260813.1","20260810.1","20260807.1","20260805.1","20260729.1","20260609.1","20260506.1","20260327.1","20260324.1","20260309.1","20260129.1","20260126.1","20260123.1","20260122.1","20251229.1","20251216.1","20251209.1","20251208.1","20251120.1","20251117.1","20251106.1","20251020.1","20250924.1","20250826.1","20250820.1","20250806.2","20250806.1","20250721.1","20250708.1","20250521.1","20250512.1","20250505.1","20250429.1","20250424.2","20250424.1","20250423.1","20250416.1","20250414.1","20250407.2","20250407.1","20250402.1","20250325.1","20250321.1","20250320.1","20250313.1","20250304.1","20250303.1","20250214.1","20250205.1","20241211.1","20241128.1","20241127.1","20241125.1","20241122.1","20241118.1","20241108.1","20241104.2","20241104.1","20241029.1","20241023.1","20241028.1","20241008.3","20241008.2","20241008.1","20241001.1","20240924.2","20240924.1","20240923.1","20240916.1","20240910.1","20240903.2","20240903.1","20240830.2","20240830.1","20240822.2","20240822.1","20240813.1","20240808.1","20240802.3","20240802.2","20240802.1","20240731.1","20240723.1","20240719.1","20240611.1","20240307.1","20240306.1","20240304.2","20240304.1","20240226.1","20240221.1","20240213.1","20240207.1","20230511.1","20230926.1","20230901.1","20230829.1","20230531.1","20230524.1","20230330.1","20230118.1","20230103.1","20221208.1","20221108.1","20221107.1","20221027.1","20220725.1","20220718.1","20220701.1","20220414.1","20220411.1","20220405.1","20210510.1","20220301.1","20220228.1","20220207.1","20220111.1","20211222.1","20211220.1","20211123.1","20211117.1","20211112.1","20211108.1","20211029.1","20210922.1","20210921.3","20210921.2","20210921.1","20210908.1","20210706.1","20210629.1","20210615.1","20210525.1","20210524.2","20210524.1","20210521.1","20210517.1","20210513.2","20210513.1","20210512.1","20210507.1","20210426.1","20210423.1","20210422.1","20210421.1","20210401.1","20210324.1","20210309.1","20210219.1","20210119.1","20210104.1","20201228.2","20201228.1","20201202.1","20201201.1","20201117.1","20201116.1","20201006.2","20201006.1","20200918.1","20200911.1","20200903.1","20200828.1","20200521.1","20200513.1","20200428.1","20200421.1","20200129.1","20200121.1","20200117.1","20200116.1","20200115.1","20191219.1","20191217.2","20191217.1","20191001.1","20190814.1","20190807.1","20190627.1","20190625.1","20190624.1","20190618.1","20190617.1","20190527.1","20190524.2","20190524.1","20190515.1","20190508.1","20190410.1","20190410.2","20190313.1","20190312.1","20190308.1","20190306.1","20190221.1","20190215.1","20190208.1","20190201.1","20190124.2","20190124.1","20190123.1","20190111.1","20190109.1","20190108.1","20190103.1","20181206.1","20181205.4","20181205.3","20181205.2","20181205.1","20181121.1","20181114.1","20181108.1","20181102.1","20181031.4","20181031.3","20181031.2","20181031.1","20181030.1","20181023.1","20180926.3","20180926.2","20180926.1","20180925.2","20180925.1","20180918.1","20180903.1","20180821.1","20180817.1","20180808.1","20180710.1","20180726.6","20180726.3","20180726.2","20180726.1","20180726.5","20180726.4","20180611.2","20180611.1","20180525.1","20180517.1","20180626.1","20080511.1","20080510.1","20180426.1","20180417.1","20180416.1","20180413.1","20180412.1","20180329.1","20180301.3","20180228.3","20180301.2","20180301.1","20180222.1","20180220.1","20180219.1","20180213.1","20180212.1","20180202.5","20180202.4","20180202.3","20180202.2","20180202.1","20180201.1","20180126.1","20180124.1","20180117.1","20180105.2","20180105.1","20180104.1","20171220.2","20171220.1","20171219.1","20171128.1","20171127.2","20171127.1","20171110.1","20171013.1","20171009.1","20171004.1","20170929.2","20170929.1","20170927.3","20170927.2","20170927.1","20170925.2","20170925.1","20170922.2","20170922.1","20170920.2","20170920.1","20170905.1","20170831.1","20170830.1","20170825.1","20170808.1","20170803.1","20170728.1","20170726.1","20170725.1","20170724.1","20170711.1","20170705.1","20170628.2","20170628.1","20170623.1","20170622.1","20170621.2","20170621.1","20170613.1","20170607.1","20170529.1","20170525.1","20170519.1","20170518.1","20170517.1","20170516.1","20170515.1","20170510.1","20170508.1","20170427.1","20170426.6","20170426.5","20170426.4","20170426.3","20170426.2","20170426.1","20170424.1","20170420.1","20170419.1","20170414.2","20170414.1","20170413.3","20170413.2","20170413.1","20170407.1","20170406.1","20170404.1","20170331.1","20170330.1","20170328.1","20170327.1","20170323.2","20170323.1","20170322.2","20170322.1","20170307.1","20170303.1","20170223.1","20170221.1","20170220.1","20170215.1","20170203.1","20170131.2","20170131.1","20170127.1","20170117.1","20170110.2","20170110.1","20170104.2","20170104.1","20160104.2","20170102.1","20161229.1","20161228.1","20161222.2","20161222.1","20161214.1","20161213.1","20161209.3","20161207.3","20161207.2","20161207.1","20161201.1","20161130.1","20161129.1","20161125.1","20161122.5","20161122.4","20161122.3","20161122.2","20161122.1","20161116.1","20161115.2","20161115.1","20161110.1","20161109.1","20161027.1","20161020.1","20161019.1","20161018.2","20161018.1","20161007.1","20161006.2","20161006.1","20161005.3","20161005.2","20161005.1","20161004.2","20161004.1","20160929.2","20160929.1","20160928.1","20160923.1","20160922.3","20160922.2","20160922.1","20160919.1","20160913.3","20160913.2","20160913.1","20160909.1","20160905.2","20160905.1","20160902.1","20160826.1","20160825.1","20160824.4","20160824.3","20160824.2","20160824.1","20160823.3","20160823.2","20160823.1","20160819.1","20160818.4","20160818.3","20160818.2","20160818.1","20160817.3","20160817.2","20160817.1","20160811.2","20160811.1","20160810.6","20160810.5","20160810.4","20160810.3","20160810.2","20160810.1","20160809.1","20160808.1","20160805.2","20160805.1","20160804.3","20160804.2","20160804.1","20160803.2","20160803.1","20160802.3","20160802.2","20160802.1","20160801.2","20160801.1","20160728.2","20160728.1","20160725.1","20160722.1","20160721.4","20160721.3","20160721.2","20160721.1","20160720.2","20160720.1","20160719.1","20160718.9","20160718.8","20160718.7","20160718.5","20160718.4","20160718.3","20160718.2","20160718.1","20160714.4","20160714.3","20160714.2","20160714.1","20160713.1","20160712.2","20160712.1","20160708.1","20160705.2","20160705.1","20160704.1","20160630.2","20160630.1","20160629.2","20160629.1","20160628.1","20160624.2","20160624.1","20160621.1","20160617.1","20160615.2","20160615.1","20160613.1","20160610.1","20160609.2","20160609.1","20160607.1","20160606.1","20160601.1","20160524.1","20160311.1","20160518.1","20160513.1","20160512.2","20160512.1","20160429.1","20160422.2","20160422.1","20160414.1","20160419.1","20160411.1","20160406.1","20160405.1","20160405.2","20160405.1_test","20160404.1","20160323.1","20160325.4","20160325.3","20160325.1","20160325.2","20160321.2","20160321.1","20160321.1_test","20160316.1","20160317.5","20160317.4","20160317.3","20160317.2","20160317.1","20160314.2_test","20160314.1_test","20160308.1","20160307.1_test","20160303.1_test","20160302.1_test","20160229.1_test","20160226.2_test","20160226.1","20160224.1","20160222.1","20160217.3","20160217.2","20160210.1","20150210.1","20160119.2","20160119.1","20151230_bulldozer_test1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111683.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}