Allegro Ralph EUVD-2026-102974

Requires a valid authenticated low-privilege 'staff' user account in Allegro Ralph; the bypass specifically triggers because RalphPermission skips authorization checks for API views that have no queryset, which is the case for DCAssetsView and SRRacksAPIView exposed at /api/rack/<id> and /api/server_room/<id>. The limiting factor is authentication: exploitation is impossible without an existing staff-level credential, and there is no user-interaction or non-default-configuration requirement, so any logged-in staff user of a default deployment can reach the affected endpoints. Impact is confined to data-center rack/server-room asset data (read of hostnames, serials, management IPs; write to rack records); it does not yield full admin or system compromise.

This is a medium-severity authorization flaw (vendor/VulnCheck CVSS 4.0 base 5.3) whose real-world risk is moderate and gated primarily by the authentication requirement. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires PR:L - a pre-existing authenticated staff account - so this is a privilege/authorization-boundary bypass by an insider or a compromised low-privilege account, not an anonymous internet-facing RCE. Impact is bounded: VC:L/VI:L/VA:N means limited confidentiality (reading asset hostnames, serials, management IPs) and limited integrity (modifying, moving, creating racks) with no availability impact and no scope change (SC/SI/SA:N). No EPSS score, KEV listing, or confirmed public exploit code was provided in the input, so there is no signal of active exploitation or automatability; SSVC-style exploitation status is therefore 'none/POC-absent' and technical impact is partial. Net: a legitimate but real authorization-bypass priority for organizations running Ralph with multiple staff-tier accounts, but not an emergency mass-exploitation threat. Key missing data: EPSS and any SSVC vendor decision are absent, and patch/fixed-version information is not provided - the affected range is stated only as 'through 20260902.1'.

A user who holds a low-privilege authenticated staff account in Allegro Ralph (or an attacker who has phished/compromised such an account) sends authenticated requests to /api/rack/<id> and /api/server_room/<id>. Because RalphPermission skips permission checks for views lacking a queryset, DCAssetsView and SRRacksAPIView return data and accept writes the user should not be authorized for, letting them harvest asset hostnames, serials, and management IPs and alter rack records. No public exploit code is identified in the provided data, though a third-party technical write-up (hackmd) describing the issue is referenced.