{"id":"CVE-2026-111683","kind":"vulnerability","aliases":["CVE-2026-111683"],"related":[],"title":"Allegro Ralph: staff users can read and change racks without permission","description":"Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks.","summary":"Ralph's permission check is skipped for some API views that have no queryset, so an authenticated staff user can call the rack and server room endpoints. An attacker can read asset hostnames, serials and management IPs, and create, move or modify racks.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asset-management","package","ralph","self-hosted"],"not_affected_if":["auth-required","no-staff-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-16T18:17:51+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:18:19+00:00","updated_at":"2026-10-25T04:18:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:18:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Allegro Ralph: staff users can read and change racks without permission","impact":"medium","summary":"Ralph's permission check is skipped for some API views that have no queryset, so an authenticated staff user can call the rack and server room endpoints. An attacker can read asset hostnames, serials and management IPs, and create, move or modify racks.","category":"package","nicknames":[],"who_cares":["ralph","self-hosted","asset-management"],"confidence":0.6,"needs_auth":"yes","worst_case":"Asset inventory readable and racks modified by any staff account","analyst_note":"Find the fixed Ralph release and a check for the affected RalphPermission behaviour in the NVD entry or the project repository.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-staff-users","auth-required"],"who_is_affected":"Teams running Allegro Ralph through 20260902.1 with staff accounts that are not meant to manage rack models. Installations where only trusted administrators hold staff access have a smaller exposure. The sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000547,"input_tokens":3359,"output_tokens":422,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111683':14A,17A '-2026':13A,16A '/api/rack':104C '/api/server_room':106C '20260902.1':72C 'allegro':1A,69C 'allow':79C 'api':34B 'asset':19B,57B,109C 'asset-manag':18B 'attack':54B,97C 'authent':42B,80C 'author':76C 'bypass':84C 'call':46B,99C 'chang':8A 'check':29B,91C 'contain':73C 'creat':64B,120C 'cve':12A,15A 'dcassetsview':100C 'endpoint':52B 'host':25B 'hostnam':58B,110C 'ip':62B,114C 'manag':20B,61B,113C 'miss':75C 'model':86C 'modifi':67B,117C 'move':65B,118C 'packag':21B 'permiss':11A,28B,87C 'queryset':39B,96C 'rack':9A,48B,68B,85C,121C 'ralph':2A,22B,26B,70C 'ralphpermiss':89C 'read':6A,56B,108C 'room':51B 'self':24B 'self-host':23B 'serial':59B,111C 'server':50B 'skip':31B,90C 'srracksapiview':102C 'staff':3A,43B,81C 'user':4A,44B,82C 'view':35B,93C 'vulner':77C 'without':10A,94C","nicknames":[],"mitigations":[],"who_affected":"Teams running Allegro Ralph through 20260902.1 with staff accounts that are not meant to manage rack models. Installations where only trusted administrators hold staff access have a smaller exposure. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111683","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111683","severity":null,"published_at":"2026-10-16T18:17:51+00:00","modified_at":"2026-10-23T14:17:31+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}