Medium
Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API
Type: advisorySources: OSV
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/ and /api/server_room/ to read asset hostnames, serials and management IPs, and to modify, move or create racks.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-111683
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 03:02 UTC · Revision 1
Source evidence
Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API
core-osv · Original sourcePublished 16 Oct 2026, 17:39 UTC
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/ and /api/server_room/ to read asset hostnames, serials and management IPs, and to modify, move or create racks.
osv:CVE-2026-111683
Complete source record
{
"id": "a8a12ec50dcf210e1801d10bb02b7f1d98e749f6d90629f8dc9a9b162b183de9",
"url": "https://osv.dev/vulnerability/CVE-2026-111683",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API",
"summary": "Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/ and /api/server_room/ to read asset hostnames, serials and management IPs, and to modify, move or create racks.",
"evidence": "osv:CVE-2026-111683",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-111683",
"aliases": [
"CVE-2026-111683"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/allegro/ralph",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "adbe619caba31425a6b28bd8913fed2500c2fd96"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "20260902.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "20260902.1"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"20260902.1",
"20260831.2",
"20260831.1",
"20260819.1",
"20260817.1",
"20260813.2",
"20260813.1",
"20260810.1",
"20260807.1",
"20260805.1",
"20260729.1",
"20260609.1",
"20260506.1",
"20260327.1",
"20260324.1",
"20260309.1",
"20260129.1",
"20260126.1",
"20260123.1",
"20260122.1",
"20251229.1",
"20251216.1",
"20251209.1",
"20251208.1",
"20251120.1",
"20251117.1",
"20251106.1",
"20251020.1",
"20250924.1",
"20250826.1",
"20250820.1",
"20250806.2",
"20250806.1",
"20250721.1",
"20250708.1",
"20250521.1",
"20250512.1",
"20250505.1",
"20250429.1",
"20250424.2",
"20250424.1",
"20250423.1",
"20250416.1",
"20250414.1",
"20250407.2",
"20250407.1",
"20250402.1",
"20250325.1",
"20250321.1",
"20250320.1",
"20250313.1",
"20250304.1",
"20250303.1",
"20250214.1",
"20250205.1",
"20241211.1",
"20241128.1",
"20241127.1",
"20241125.1",
"20241122.1",
"20241118.1",
"20241108.1",
"20241104.2",
"20241104.1",
"20241029.1",
"20241023.1",
"20241028.1",
"20241008.3",
"20241008.2",
"20241008.1",
"20241001.1",
"20240924.2",
"20240924.1",
"20240923.1",
"20240916.1",
"20240910.1",
"20240903.2",
"20240903.1",
"20240830.2",
"20240830.1",
"20240822.2",
"20240822.1",
"20240813.1",
"20240808.1",
"20240802.3",
"20240802.2",
"20240802.1",
"20240731.1",
"20240723.1",
"20240719.1",
"20240611.1",
"20240307.1",
"20240306.1",
"20240304.2",
"20240304.1",
"20240226.1",
"20240221.1",
"20240213.1",
"20240207.1",
"20230511.1",
"20230926.1",
"20230901.1",
"20230829.1",
"20230531.1",
"20230524.1",
"20230330.1",
"20230118.1",
"20230103.1",
"20221208.1",
"20221108.1",
"20221107.1",
"20221027.1",
"20220725.1",
"20220718.1",
"20220701.1",
"20220414.1",
"20220411.1",
"20220405.1",
"20210510.1",
"20220301.1",
"20220228.1",
"20220207.1",
"20220111.1",
"20211222.1",
"20211220.1",
"20211123.1",
"20211117.1",
"20211112.1",
"20211108.1",
"20211029.1",
"20210922.1",
"20210921.3",
"20210921.2",
"20210921.1",
"20210908.1",
"20210706.1",
"20210629.1",
"20210615.1",
"20210525.1",
"20210524.2",
"20210524.1",
"20210521.1",
"20210517.1",
"20210513.2",
"20210513.1",
"20210512.1",
"20210507.1",
"20210426.1",
"20210423.1",
"20210422.1",
"20210421.1",
"20210401.1",
"20210324.1",
"20210309.1",
"20210219.1",
"20210119.1",
"20210104.1",
"20201228.2",
"20201228.1",
"20201202.1",
"20201201.1",
"20201117.1",
"20201116.1",
"20201006.2",
"20201006.1",
"20200918.1",
"20200911.1",
"20200903.1",
"20200828.1",
"20200521.1",
"20200513.1",
"20200428.1",
"20200421.1",
"20200129.1",
"20200121.1",
"20200117.1",
"20200116.1",
"20200115.1",
"20191219.1",
"20191217.2",
"20191217.1",
"20191001.1",
"20190814.1",
"20190807.1",
"20190627.1",
"20190625.1",
"20190624.1",
"20190618.1",
"20190617.1",
"20190527.1",
"20190524.2",
"20190524.1",
"20190515.1",
"20190508.1",
"20190410.1",
"20190410.2",
"20190313.1",
"20190312.1",
"20190308.1",
"20190306.1",
"20190221.1",
"20190215.1",
"20190208.1",
"20190201.1",
"20190124.2",
"20190124.1",
"20190123.1",
"20190111.1",
"20190109.1",
"20190108.1",
"20190103.1",
"20181206.1",
"20181205.4",
"20181205.3",
"20181205.2",
"20181205.1",
"20181121.1",
"20181114.1",
"20181108.1",
"20181102.1",
"20181031.4",
"20181031.3",
"20181031.2",
"20181031.1",
"20181030.1",
"20181023.1",
"20180926.3",
"20180926.2",
"20180926.1",
"20180925.2",
"20180925.1",
"20180918.1",
"20180903.1",
"20180821.1",
"20180817.1",
"20180808.1",
"20180710.1",
"20180726.6",
"20180726.3",
"20180726.2",
"20180726.1",
"20180726.5",
"20180726.4",
"20180611.2",
"20180611.1",
"20180525.1",
"20180517.1",
"20180626.1",
"20080511.1",
"20080510.1",
"20180426.1",
"20180417.1",
"20180416.1",
"20180413.1",
"20180412.1",
"20180329.1",
"20180301.3",
"20180228.3",
"20180301.2",
"20180301.1",
"20180222.1",
"20180220.1",
"20180219.1",
"20180213.1",
"20180212.1",
"20180202.5",
"20180202.4",
"20180202.3",
"20180202.2",
"20180202.1",
"20180201.1",
"20180126.1",
"20180124.1",
"20180117.1",
"20180105.2",
"20180105.1",
"20180104.1",
"20171220.2",
"20171220.1",
"20171219.1",
"20171128.1",
"20171127.2",
"20171127.1",
"20171110.1",
"20171013.1",
"20171009.1",
"20171004.1",
"20170929.2",
"20170929.1",
"20170927.3",
"20170927.2",
"20170927.1",
"20170925.2",
"20170925.1",
"20170922.2",
"20170922.1",
"20170920.2",
"20170920.1",
"20170905.1",
"20170831.1",
"20170830.1",
"20170825.1",
"20170808.1",
"20170803.1",
"20170728.1",
"20170726.1",
"20170725.1",
"20170724.1",
"20170711.1",
"20170705.1",
"20170628.2",
"20170628.1",
"20170623.1",
"20170622.1",
"20170621.2",
"20170621.1",
"20170613.1",
"20170607.1",
"20170529.1",
"20170525.1",
"20170519.1",
"20170518.1",
"20170517.1",
"20170516.1",
"20170515.1",
"20170510.1",
"20170508.1",
"20170427.1",
"20170426.6",
"20170426.5",
"20170426.4",
"20170426.3",
"20170426.2",
"20170426.1",
"20170424.1",
"20170420.1",
"20170419.1",
"20170414.2",
"20170414.1",
"20170413.3",
"20170413.2",
"20170413.1",
"20170407.1",
"20170406.1",
"20170404.1",
"20170331.1",
"20170330.1",
"20170328.1",
"20170327.1",
"20170323.2",
"20170323.1",
"20170322.2",
"20170322.1",
"20170307.1",
"20170303.1",
"20170223.1",
"20170221.1",
"20170220.1",
"20170215.1",
"20170203.1",
"20170131.2",
"20170131.1",
"20170127.1",
"20170117.1",
"20170110.2",
"20170110.1",
"20170104.2",
"20170104.1",
"20160104.2",
"20170102.1",
"20161229.1",
"20161228.1",
"20161222.2",
"20161222.1",
"20161214.1",
"20161213.1",
"20161209.3",
"20161207.3",
"20161207.2",
"20161207.1",
"20161201.1",
"20161130.1",
"20161129.1",
"20161125.1",
"20161122.5",
"20161122.4",
"20161122.3",
"20161122.2",
"20161122.1",
"20161116.1",
"20161115.2",
"20161115.1",
"20161110.1",
"20161109.1",
"20161027.1",
"20161020.1",
"20161019.1",
"20161018.2",
"20161018.1",
"20161007.1",
"20161006.2",
"20161006.1",
"20161005.3",
"20161005.2",
"20161005.1",
"20161004.2",
"20161004.1",
"20160929.2",
"20160929.1",
"20160928.1",
"20160923.1",
"20160922.3",
"20160922.2",
"20160922.1",
"20160919.1",
"20160913.3",
"20160913.2",
"20160913.1",
"20160909.1",
"20160905.2",
"20160905.1",
"20160902.1",
"20160826.1",
"20160825.1",
"20160824.4",
"20160824.3",
"20160824.2",
"20160824.1",
"20160823.3",
"20160823.2",
"20160823.1",
"20160819.1",
"20160818.4",
"20160818.3",
"20160818.2",
"20160818.1",
"20160817.3",
"20160817.2",
"20160817.1",
"20160811.2",
"20160811.1",
"20160810.6",
"20160810.5",
"20160810.4",
"20160810.3",
"20160810.2",
"20160810.1",
"20160809.1",
"20160808.1",
"20160805.2",
"20160805.1",
"20160804.3",
"20160804.2",
"20160804.1",
"20160803.2",
"20160803.1",
"20160802.3",
"20160802.2",
"20160802.1",
"20160801.2",
"20160801.1",
"20160728.2",
"20160728.1",
"20160725.1",
"20160722.1",
"20160721.4",
"20160721.3",
"20160721.2",
"20160721.1",
"20160720.2",
"20160720.1",
"20160719.1",
"20160718.9",
"20160718.8",
"20160718.7",
"20160718.5",
"20160718.4",
"20160718.3",
"20160718.2",
"20160718.1",
"20160714.4",
"20160714.3",
"20160714.2",
"20160714.1",
"20160713.1",
"20160712.2",
"20160712.1",
"20160708.1",
"20160705.2",
"20160705.1",
"20160704.1",
"20160630.2",
"20160630.1",
"20160629.2",
"20160629.1",
"20160628.1",
"20160624.2",
"20160624.1",
"20160621.1",
"20160617.1",
"20160615.2",
"20160615.1",
"20160613.1",
"20160610.1",
"20160609.2",
"20160609.1",
"20160607.1",
"20160606.1",
"20160601.1",
"20160524.1",
"20160311.1",
"20160518.1",
"20160513.1",
"20160512.2",
"20160512.1",
"20160429.1",
"20160422.2",
"20160422.1",
"20160414.1",
"20160419.1",
"20160411.1",
"20160406.1",
"20160405.1",
"20160405.2",
"20160405.1_test",
"20160404.1",
"20160323.1",
"20160325.4",
"20160325.3",
"20160325.1",
"20160325.2",
"20160321.2",
"20160321.1",
"20160321.1_test",
"20160316.1",
"20160317.5",
"20160317.4",
"20160317.3",
"20160317.2",
"20160317.1",
"20160314.2_test",
"20160314.1_test",
"20160308.1",
"20160307.1_test",
"20160303.1_test",
"20160302.1_test",
"20160229.1_test",
"20160226.2_test",
"20160226.1",
"20160224.1",
"20160222.1",
"20160217.3",
"20160217.2",
"20160210.1",
"20150210.1",
"20160119.2",
"20160119.1",
"20151230_bulldozer_test1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111683.json"
}
}
],
"modified": "2026-10-28T02:30:41.991757276Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111683.json",
"https://hackmd.io/@hieuPenguinnn/ralph-dc-view-rack-api-missing-authorization",
"https://nvd.nist.gov/vuln/detail/CVE-2026-111683",
"https://www.vulncheck.com/advisories/allegro-ralph-through-20260902.1-missing-authorization-in-data-center-rack-api",
"https://github.com/allegro/ralph",
"https://github.com/allegro/ralph/blob/20260902.1/src/ralph/dc_view/views/api.py#L17-L96",
"https://github.com/allegro/ralph/blob/20260902.1/src/ralph/lib/permissions/api.py#L194-L209"
],
"provider_metadata": {
"cwe_ids": [
"CWE-862"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111683.json"
}
},
"related_cves": [
{
"value": "CVE-2026-111683",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 509700,
"published_at": "2026-10-16T17:39:40.888+00:00"
}