Live › vulnerability › CVE-2026-111683
Go to dashboardRalph's permission check is skipped for some API views that have no queryset, so an authenticated staff user can call the rack and server room endpoints. An attacker can read asset hostnames, serials and management IPs, and create, move or modify racks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Allegro Ralph through 20260902.1 with staff accounts that are not meant to manage rack models. Installations where only trusted administrators hold staff access have a smaller exposure. The sources do not name a fixed version.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks.
This page as .md · .json · in your agent: get_signal("CVE-2026-111683")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.