Allegro Ralph releases through 20260902.1 contain a missing authorization flaw that allows staff users with authentication but lacking proper rack model permissions to read and manipulate rack information. The flaw arises because RalphPermission does not enforce checks for views that do not use a queryset, enabling the DCAssetsView and SRRacksAPIView endpoints at /api/rack/<id> and /api/server_room/<id> to expose sensitive asset hostnames, serial numbers and management IPs, as well as to create, move or delete racks. This creates a risk of data disclosure and unauthorized configuration changes, falling under Missing Authorization (CWE‑862).

The vulnerability affects all instances of Allegro Ralph up to and including the 20260902.1 release. Systems running any earlier 2026.x series of the product are also potentially impacted until a patch is applied. No specific minor version details are provided beyond the 20260902.1 cutoff.

The CVSS score of 5.3 indicates a moderate severity, and the lack of an EPSS score means public exploitation likelihood is currently undetermined. The issue is not listed in the CISA KEV catalog, suggesting no known active exploits yet. Attackers must be authenticated staff; therefore, the attack vector is likely internal or via compromised credentials, but they can read sensitive data and alter rack configurations if they target the exposed API endpoints.