CVE-2026-111683

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111683

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111683.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111683

Published

2026-10-16T17:39:40Z

Modified

2026-10-21T02:55:49Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API

Details

Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/ and /api/server_room/ to read asset hostnames, serials and management IPs, and to modify, move or create racks.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111683.json"
}

References

Affected packages

Git / github.com/allegro/ralph

Affected ranges

Type

GIT

Repo

https://github.com/allegro/ralph

Events

Introduced

Last Affected

adbe619caba31425a6b28bd8913fed2500c2fd96

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "20260902.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

20080510.*

20080510.1

20080511.*

20080511.1

20150210.*

20150210.1

Other

20151230_bulldozer_test1

20160104.*

20160104.2

20160119.*

20160119.1

20160119.2

20160210.*

20160210.1

20160217.*

20160217.2

20160217.3

20160222.*

20160222.1

20160224.*

20160224.1

20160226.*

20160226.1

20160226.2_test

20160229.*

20160229.1_test

20160302.*

20160302.1_test

20160303.*

20160303.1_test

20160307.*

20160307.1_test

20160308.*

20160308.1

20160311.*

20160311.1

20160314.*

20160314.1_test

20160314.2_test

20160316.*

20160316.1

20160317.*

20160317.1

20160317.2

20160317.3

20160317.4

20160317.5

20160321.*

20160321.1

20160321.1_test

20160321.2

20160323.*

20160323.1

20160325.*

20160325.1

20160325.2

20160325.3

20160325.4

20160404.*

20160404.1

20160405.*

20160405.1

20160405.1_test

20160405.2

20160406.*

20160406.1

20160411.*

20160411.1

20160414.*

20160414.1

20160419.*

20160419.1

20160422.*

20160422.1

20160422.2

20160429.*

20160429.1

20160512.*

20160512.1

20160512.2

20160513.*

20160513.1

20160518.*

20160518.1

20160524.*

20160524.1

20160601.*

20160601.1

20160606.*

20160606.1

20160607.*

20160607.1

20160609.*

20160609.1

20160609.2

20160610.*

20160610.1

20160613.*

20160613.1

20160615.*

20160615.1

20160615.2

20160617.*

20160617.1

20160621.*

20160621.1

20160624.*

20160624.1

20160624.2

20160628.*

20160628.1

20160629.*

20160629.1

20160629.2

20160630.*

20160630.1

20160630.2

20160704.*

20160704.1

20160705.*

20160705.1

20160705.2

20160708.*

20160708.1

20160712.*

20160712.1

20160712.2

20160713.*

20160713.1

20160714.*

20160714.1

20160714.2

20160714.3

20160714.4

20160718.*

20160718.1

20160718.2

20160718.3

20160718.4

20160718.5

20160718.7

20160718.8

20160718.9

20160719.*

20160719.1

20160720.*

20160720.1

20160720.2

20160721.*

20160721.1

20160721.2

20160721.3

20160721.4

20160722.*

20160722.1

20160725.*

20160725.1

20160728.*

20160728.1

20160728.2

20160801.*

20160801.1

20160801.2

20160802.*

20160802.1

20160802.2

20160802.3

20160803.*

20160803.1

20160803.2

20160804.*

20160804.1

20160804.2

20160804.3

20160805.*

20160805.1

20160805.2

20160808.*

20160808.1

20160809.*

20160809.1

20160810.*

20160810.1

20160810.2

20160810.3

20160810.4

20160810.5

20160810.6

20160811.*

20160811.1

20160811.2

20160817.*

20160817.1

20160817.2

20160817.3

20160818.*

20160818.1

20160818.2

20160818.3

20160818.4

20160819.*

20160819.1

20160823.*

20160823.1

20160823.2

20160823.3

20160824.*

20160824.1

20160824.2

20160824.3

20160824.4

20160825.*

20160825.1

20160826.*

20160826.1

20160902.*

20160902.1

20160905.*

20160905.1

20160905.2

20160909.*

20160909.1

20160913.*

20160913.1

20160913.2

20160913.3

20160919.*

20160919.1

20160922.*

20160922.1

20160922.2

20160922.3

20160923.*

20160923.1

20160928.*

20160928.1

20160929.*

20160929.1

20160929.2

20161004.*

20161004.1

20161004.2

20161005.*

20161005.1

20161005.2

20161005.3

20161006.*

20161006.1

20161006.2

20161007.*

20161007.1

20161018.*

20161018.1

20161018.2

20161019.*

20161019.1

20161020.*

20161020.1

20161027.*

20161027.1

20161109.*

20161109.1

20161110.*

20161110.1

20161115.*

20161115.1

20161115.2

20161116.*

20161116.1

20161122.*

20161122.1

20161122.2

20161122.3

20161122.4

20161122.5

20161125.*

20161125.1

20161129.*

20161129.1

20161130.*

20161130.1

20161201.*

20161201.1

20161207.*

20161207.1

20161207.2

20161207.3

20161209.*

20161209.3

20161213.*

20161213.1

20161214.*

20161214.1

20161222.*

20161222.1

20161222.2

20161228.*

20161228.1

20161229.*

20161229.1

20170102.*

20170102.1

20170104.*

20170104.1

20170104.2

20170110.*

20170110.1

20170110.2

20170117.*

20170117.1

20170127.*

20170127.1

20170131.*

20170131.1

20170131.2

20170203.*

20170203.1

20170215.*

20170215.1

20170220.*

20170220.1

20170221.*

20170221.1

20170223.*

20170223.1

20170303.*

20170303.1

20170307.*

20170307.1

20170322.*

20170322.1

20170322.2

20170323.*

20170323.1

20170323.2

20170327.*

20170327.1

20170328.*

20170328.1

20170330.*

20170330.1

20170331.*

20170331.1

20170404.*

20170404.1

20170406.*

20170406.1

20170407.*

20170407.1

20170413.*

20170413.1

20170413.2

20170413.3

20170414.*

20170414.1

20170414.2

20170419.*

20170419.1

20170420.*

20170420.1

20170424.*

20170424.1

20170426.*

20170426.1

20170426.2

20170426.3

20170426.4

20170426.5

20170426.6

20170427.*

20170427.1

20170508.*

20170508.1

20170510.*

20170510.1

20170515.*

20170515.1

20170516.*

20170516.1

20170517.*

20170517.1

20170518.*

20170518.1

20170519.*

20170519.1

20170525.*

20170525.1

20170529.*

20170529.1

20170607.*

20170607.1

20170613.*

20170613.1

20170621.*

20170621.1

20170621.2

20170622.*

20170622.1

20170623.*

20170623.1

20170628.*

20170628.1

20170628.2

20170705.*

20170705.1

20170711.*

20170711.1

20170724.*

20170724.1

20170725.*

20170725.1

20170726.*

20170726.1

20170728.*

20170728.1

20170803.*

20170803.1

20170808.*

20170808.1

20170825.*

20170825.1

20170830.*

20170830.1

20170831.*

20170831.1

20170905.*

20170905.1

20170920.*

20170920.1

20170920.2

20170922.*

20170922.1

20170922.2

20170925.*

20170925.1

20170925.2

20170927.*

20170927.1

20170927.2

20170927.3

20170929.*

20170929.1

20170929.2

20171004.*

20171004.1

20171009.*

20171009.1

20171013.*

20171013.1

20171110.*

20171110.1

20171127.*

20171127.1

20171127.2

20171128.*

20171128.1

20171219.*

20171219.1

20171220.*

20171220.1

20171220.2

20180104.*

20180104.1

20180105.*

20180105.1

20180105.2

20180117.*

20180117.1

20180124.*

20180124.1

20180126.*

20180126.1

20180201.*

20180201.1

20180202.*

20180202.1

20180202.2

20180202.3

20180202.4

20180202.5

20180212.*

20180212.1

20180213.*

20180213.1

20180219.*

20180219.1

20180220.*

20180220.1

20180222.*

20180222.1

20180228.*

20180228.3

20180301.*

20180301.1

20180301.2

20180301.3

20180329.*

20180329.1

20180412.*

20180412.1

20180413.*

20180413.1

20180416.*

20180416.1

20180417.*

20180417.1

20180426.*

20180426.1

20180517.*

20180517.1

20180525.*

20180525.1

20180611.*

20180611.1

20180611.2

20180626.*

20180626.1

20180710.*

20180710.1

20180726.*

20180726.1

20180726.2

20180726.3

20180726.4

20180726.5

20180726.6

20180808.*

20180808.1

20180817.*

20180817.1

20180821.*

20180821.1

20180903.*

20180903.1

20180918.*

20180918.1

20180925.*

20180925.1

20180925.2

20180926.*

20180926.1

20180926.2

20180926.3

20181023.*

20181023.1

20181030.*

20181030.1

20181031.*

20181031.1

20181031.2

20181031.3

20181031.4

20181102.*

20181102.1

20181108.*

20181108.1

20181114.*

20181114.1

20181121.*

20181121.1

20181205.*

20181205.1

20181205.2

20181205.3

20181205.4

20181206.*

20181206.1

20190103.*

20190103.1

20190108.*

20190108.1

20190109.*

20190109.1

20190111.*

20190111.1

20190123.*

20190123.1

20190124.*

20190124.1

20190124.2

20190201.*

20190201.1

20190208.*

20190208.1

20190215.*

20190215.1

20190221.*

20190221.1

20190306.*

20190306.1

20190308.*

20190308.1

20190312.*

20190312.1

20190313.*

20190313.1

20190410.*

20190410.1

20190410.2

20190508.*

20190508.1

20190515.*

20190515.1

20190524.*

20190524.1

20190524.2

20190527.*

20190527.1

20190617.*

20190617.1

20190618.*

20190618.1

20190624.*

20190624.1

20190625.*

20190625.1

20190627.*

20190627.1

20190807.*

20190807.1

20190814.*

20190814.1

20191001.*

20191001.1

20191217.*

20191217.1

20191217.2

20191219.*

20191219.1

20200115.*

20200115.1

20200116.*

20200116.1

20200117.*

20200117.1

20200121.*

20200121.1

20200129.*

20200129.1

20200421.*

20200421.1

20200428.*

20200428.1

20200513.*

20200513.1

20200521.*

20200521.1

20200828.*

20200828.1

20200903.*

20200903.1

20200911.*

20200911.1

20200918.*

20200918.1

20201006.*

20201006.1

20201006.2

20201116.*

20201116.1

20201117.*

20201117.1

20201201.*

20201201.1

20201202.*

20201202.1

20201228.*

20201228.1

20201228.2

20210104.*

20210104.1

20210119.*

20210119.1

20210219.*

20210219.1

20210309.*

20210309.1

20210324.*

20210324.1

20210401.*

20210401.1

20210421.*

20210421.1

20210422.*

20210422.1

20210423.*

20210423.1

20210426.*

20210426.1

20210507.*

20210507.1

20210510.*

20210510.1

20210512.*

20210512.1

20210513.*

20210513.1

20210513.2

20210517.*

20210517.1

20210521.*

20210521.1

20210524.*

20210524.1

20210524.2

20210525.*

20210525.1

20210615.*

20210615.1

20210629.*

20210629.1

20210706.*

20210706.1

20210908.*

20210908.1

20210921.*

20210921.1

20210921.2

20210921.3

20210922.*

20210922.1

20211029.*

20211029.1

20211108.*

20211108.1

20211112.*

20211112.1

20211117.*

20211117.1

20211123.*

20211123.1

20211220.*

20211220.1

20211222.*

20211222.1

20220111.*

20220111.1

20220207.*

20220207.1

20220228.*

20220228.1

20220301.*

20220301.1

20220405.*

20220405.1

20220411.*

20220411.1

20220414.*

20220414.1

20220701.*

20220701.1

20220718.*

20220718.1

20220725.*

20220725.1

20221027.*

20221027.1

20221107.*

20221107.1

20221108.*

20221108.1

20221208.*

20221208.1

20230103.*

20230103.1

20230118.*

20230118.1

20230330.*

20230330.1

20230511.*

20230511.1

20230524.*

20230524.1

20230531.*

20230531.1

20230829.*

20230829.1

20230901.*

20230901.1

20230926.*

20230926.1

20240207.*

20240207.1

20240213.*

20240213.1

20240221.*

20240221.1

20240226.*

20240226.1

20240304.*

20240304.1

20240304.2

20240306.*

20240306.1

20240307.*

20240307.1

20240611.*

20240611.1

20240719.*

20240719.1

20240723.*

20240723.1

20240731.*

20240731.1

20240802.*

20240802.1

20240802.2

20240802.3

20240808.*

20240808.1

20240813.*

20240813.1

20240822.*

20240822.1

20240822.2

20240830.*

20240830.1

20240830.2

20240903.*

20240903.1

20240903.2

20240910.*

20240910.1

20240916.*

20240916.1

20240923.*

20240923.1

20240924.*

20240924.1

20240924.2

20241001.*

20241001.1

20241008.*

20241008.1

20241008.2

20241008.3

20241023.*

20241023.1

20241028.*

20241028.1

20241029.*

20241029.1

20241104.*

20241104.1

20241104.2

20241108.*

20241108.1

20241118.*

20241118.1

20241122.*

20241122.1

20241125.*

20241125.1

20241127.*

20241127.1

20241128.*

20241128.1

20241211.*

20241211.1

20250205.*

20250205.1

20250214.*

20250214.1

20250303.*

20250303.1

20250304.*

20250304.1

20250313.*

20250313.1

20250320.*

20250320.1

20250321.*

20250321.1

20250325.*

20250325.1

20250402.*

20250402.1

20250407.*

20250407.1

20250407.2

20250414.*

20250414.1

20250416.*

20250416.1

20250423.*

20250423.1

20250424.*

20250424.1

20250424.2

20250429.*

20250429.1

20250505.*

20250505.1

20250512.*

20250512.1

20250521.*

20250521.1

20250708.*

20250708.1

20250721.*

20250721.1

20250806.*

20250806.1

20250806.2

20250820.*

20250820.1

20250826.*

20250826.1

20250924.*

20250924.1

20251020.*

20251020.1

20251106.*

20251106.1

20251117.*

20251117.1

20251120.*

20251120.1

20251208.*

20251208.1

20251209.*

20251209.1

20251216.*

20251216.1

20251229.*

20251229.1

20260122.*

20260122.1

20260123.*

20260123.1

20260126.*

20260126.1

20260129.*

20260129.1

20260309.*

20260309.1

20260324.*

20260324.1

20260327.*

20260327.1

20260506.*

20260506.1

20260609.*

20260609.1

20260729.*

20260729.1

20260805.*

20260805.1

20260807.*

20260807.1

20260810.*

20260810.1

20260813.*

20260813.1

20260813.2

20260817.*

20260817.1

20260819.*

20260819.1

20260831.*

20260831.1

20260831.2

20260902.*

20260902.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111683.json"