CVE-2026-111683
Received Received - Intake

Allegro Ralph Missing Authorization Bypass

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111683
EUVD
EUVD-2026-102974

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
allegro ralph 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Allegro Ralph allows authenticated staff users to bypass rack model permissions due to missing authorization checks in RalphPermission. Attackers can access and modify rack-related data by calling specific API endpoints without proper permission validation.

Detection Guidance

Check Ralph's API endpoints for unauthorized access to /api/rack/<id> and /api/server_room/<id>. Monitor logs for unusual GET/POST requests to these paths by authenticated staff users. Verify if DCAssetsView and SRRacksAPIView return asset details without proper permission checks.

Impact Analysis

An attacker with staff access could read sensitive asset details like hostnames, serials, and management IPs. They could also modify, move, or create racks, potentially disrupting infrastructure or gaining unauthorized access to systems.

Mitigation Strategies

Update Allegro Ralph to the latest version that patches the missing authorization flaw. Restrict staff user permissions to enforce strict queryset checks in RalphPermission. Disable or audit API endpoints /api/rack/<id> and /api/server_room/<id> for unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111683. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart