CVE-2026-111683
CVE-2026-111683 · Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks.
CVSS 5.3 · Media · EPSS 0,3%
- Publicación
- Actualización
Productos y versiones afectados
ralph
- Versiones
- ≥ 0, ≤ 20260902.1: Afectada (custom)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@hieuPenguinnn/ralph-dc-view-rack-api-missing-authorization
- https://github.com/allegro/ralph/blob/20260902.1/src/ralph/dc_view/views/api.py#L17-L96
- https://github.com/allegro/ralph/blob/20260902.1/src/ralph/lib/permissions/api.py#L194-L209
- https://github.com/allegro/ralph
- https://www.vulncheck.com/advisories/allegro-ralph-through-20260902.1-missing-authorization-in-data-center-rack-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-111683