CVE-2026-3322 PUBLISHED

Privilege escalation via request replaying in Lobster_pro

Assigner: SCHUTZWERK
Reserved: 27.02.2026 Published: 26.10.2026 Updated: 26.10.2026

Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:A
CVSS Score: 5.6

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Adjacent	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	Present	Availability	None	Availability	None
Privileges Required	Low
User Interaction	Passive

CVSS 4.0

Product Status

Vendor	Lobster DATA GmbH
Product	Lobster_pro
Versions	Default: unknown Version 4.12.12-LTS is affected Version 25.1.3 is unaffected

Solutions

Update Lobster_pro to version 25.1.3 or later.

Credits

Daniel Marner of SCHUTZWERK GmbH finder

References

https://www.schutzwerk.com/en/blog/schutzwerk-sa-2025-002/

Problem Types

CWE-280 Improper handling of insufficient permissions or privileges CWE

Impacts

CAPEC-233 Privilege Escalation