Security: GraphViewSet bypasses RalphPermission and PermissionsForObjectFilter (CWE-862)

[lighthousekeeper1212]

Summary

The GraphViewSet in the dashboards API uses the base DRF ReadOnlyModelViewSet instead of RalphReadOnlyAPIViewSet, bypassing all authorization checks that every other API viewset enforces.

Vulnerability Details

File: src/ralph/dashboards/api/views.py (line 7)

class GraphViewSet(ReadOnlyModelViewSet):  # Wrong base class
    queryset = Graph.objects.filter(active=True)

Every other ViewSet in the codebase uses RalphAPIViewSet or RalphReadOnlyAPIViewSet, which enforce:

1. RalphPermission - Django admin permissions + staff-only check
2. PermissionsForObjectFilter - Object-level access control

The RalphAPIViewSetMixin.__init__ (line 91-96 in api/viewsets.py) validates these are present:

if RalphPermission not in self.permission_classes:
    raise AttributeError("RalphPermission missing in permission_classes")

But GraphViewSet bypasses this entirely by not inheriting from the Ralph base class.

Fix

Change the base class:

from ralph.api.viewsets import RalphReadOnlyAPIViewSet

class GraphViewSet(RalphReadOnlyAPIViewSet):
    queryset = Graph.objects.filter(active=True)

CWE

• CWE-862: Missing Authorization

Severity

Medium - Any authenticated user (not necessarily staff) can list and read all active graph configurations.