---
id: "CVE-2026-111683"
kind: "vulnerability"
aliases: ["CVE-2026-111683"]
title: "Allegro Ralph: staff users can read and change racks without permission"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["asset-management", "package", "ralph", "self-hosted"]
not_affected_if: ["auth-required", "no-staff-users"]
published_at: "2026-10-16T18:17:51+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:18:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111683", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Allegro Ralph: staff users can read and change racks without permission

Ralph's permission check is skipped for some API views that have no queryset, so an authenticated staff user can call the rack and server room endpoints. An attacker can read asset hostnames, serials and management IPs, and create, move or modify racks.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111683

## From the sources

Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_