Missing Authorization Vulnerability in Allegro Ralph Data Center Rack API

CVE-2026-111683

What is CVE-2026-111683?

The Allegro Ralph application prior to version 20260902.1 suffers from a missing authorization vulnerability. This issue permits authenticated staff users to bypass essential rack model permission checks, owing to the lack of queryset validations in the RalphPermission logic. As a result, attackers can exploit two specific API endpoints—DCAssetsView and SRRacksAPIView—accessible via /api/rack/ and /api/server_room/. This security flaw enables unauthorized access to sensitive information, including asset hostnames, serials, and management IPs. Moreover, attackers can manipulate, relocate, or create rack entries, jeopardizing the integrity and security of the data center environment.

References