Ralph
Monthly
Missing authorization in Allegro Ralph through 20260902.1 lets any authenticated staff-level user read data-center asset details and manipulate racks through the API. Because RalphPermission skips checks for views that lack a queryset, the DCAssetsView and SRRacksAPIView endpoints at /api/rack/<id> and /api/server_room/<id> are reachable without the rack model permissions they should require, exposing asset hostnames, serials and management IPs and allowing rack creation, modification or movement. No public exploit code has been identified at time of analysis, and the flaw is rated medium severity (CVSS 4.0 base 5.3; independent CVSS 3.1 base 5.3) with risk gated by the need for a valid low-privilege staff credential.
Missing authorization in Allegro Ralph through 20260902.1 lets any authenticated staff-level user read data-center asset details and manipulate racks through the API. Because RalphPermission skips checks for views that lack a queryset, the DCAssetsView and SRRacksAPIView endpoints at /api/rack/<id> and /api/server_room/<id> are reachable without the rack model permissions they should require, exposing asset hostnames, serials and management IPs and allowing rack creation, modification or movement. No public exploit code has been identified at time of analysis, and the flaw is rated medium severity (CVSS 4.0 base 5.3; independent CVSS 3.1 base 5.3) with risk gated by the need for a valid low-privilege staff credential.