https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 19:36:43 +0000 https://db.gcve.eu/vuln/cve-2026-111683 <p><strong>Affected:</strong> allegro ralph</p> <p>Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/&lt;id&gt; and /api/server_room/&lt;id&gt; to read asset hostnames, serials and management IPs, and to modify, move or create racks.</p> <p><strong>Affected:</strong> allegro ralph</p> <p>Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/&lt;id&gt; and /api/server_room/&lt;id&gt; to read asset hostnames, serials and management IPs, and to modify, move or create racks.</p> https://db.gcve.eu/vuln/cve-2026-111683