CVE-2026-111683
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model p
CVSS
5.4
Média
EPSS
0.3%
p22
KEV
—
Exploit Today
7
0-100
Publicado: 16 de out. de 2026 · Última mod.: 23 de out. de 2026 · CWE-862
0.2%EPSS · 30 dias0.3%
2026-10-172026-11-06
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks.
- github.comhttps://github.com/allegro/ralph
- github.comhttps://github.com/allegro/ralph/blob/20260902.1/src/ralph/dc_view/views/api.py#L17-L96
- github.comhttps://github.com/allegro/ralph/blob/20260902.1/src/ralph/lib/permissions/api.py#L194-L209
- hackmd.iohttps://hackmd.io/@hieuPenguinnn/ralph-dc-view-rack-api-missing-authorization
- www.vulncheck.comhttps://www.vulncheck.com/advisories/allegro-ralph-through-20260902.1-missing-authorization-in-data-center-rack-api
- hackmd.iohttps://hackmd.io/@hieuPenguinnn/ralph-dc-view-rack-api-missing-authorization
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1234745.3 MÉD—
———Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18.4hCVE-2026-1234674.3 MÉD—
———Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128.4hCVE-2026-1234625.3 MÉD—
———Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.4hCVE-2026-1226635.3 MÉD—
———Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20.4hCVE-2026-1226604.3 MÉD—
———Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5.4hCVE-2026-1226595.4 MÉD—
———Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through 2.5.0.4h