CVE-2026-111683 Details

A missing authorization vulnerability has been identified in Allegro Ralph versions through 20260902.1. This vulnerability allows authenticated staff users to bypass rack model permissions. The issue arises because the default permission class, RalphPermission, skips authorization checks for views that do not have a queryset defined. As a result, staff users can exploit the DCAssetsView and SRRacksAPIView endpoints to read, modify, and create data center racks without the necessary permissions.

The vulnerability can be addressed by adding proper permission checks to the affected API views. This can be done by setting 'permission_classes' to enforce model-specific permissions or by binding a queryset that the default permission class can evaluate. Additionally, object-level permission checks should be implemented to ensure that users can only modify or access data they are authorized to.