Advisory: Privilege escalation via request replaying in Lobster_pro (CVE-2026-3322)
Release of SCHUTZWERK-SA-2025-002
October 26, 2026
Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.
Metadata
- Affected product: Lobster_pro
- Affected version: 4.12.12-LTS and potentially other versions prior to 25.1.3
- Vendor: Lobster DATA GmbH
- Problem type(s): CWE-280 Improper Handling of Insufficient Permissions or Privileges
- CVE ID: CVE-2026-3322
- CVE URL: https://www.cve.org/CVERecord?id=CVE-2026-3322
- CVSS 4.0 score: 5.6
- Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2025-002/
Details
The endpoint https://lobster-pro-instance:443/BASE/user/search/tuple allows administrators to retrieve the list of registered users for editing. Authenticated attackers with non-administrative privileges who have access to an administrative request can replay the request with their own session ID and gain access to personal data. Attackers only need to replace the headers X-Env-Clientid and X-Env-Sessiontoken with the values of their own unprivileged session. Similar attacks are likely possible by manually forging the correct ActionMessageFormat
request data instead of intercepting an administrative request.
Risk
An attacker can use this vulnerability to download a list of registered users or potentially perform other unauthorized actions. The amount of data exposed depends on the information stored in Lobster_pro.
Solution/Mitigation
Update Lobster_pro to version 25.1.3 or later.
Timeline
- 2025-06-26 Vulnerability reported to vendor
- 2025-10-09 Vendor releases version 25.0.1 to address the vulnerability
- 2025-11-19 Vendor releases version 25.1.3 with additional fixes
- 2025-11-19 Vendor informs SCHUTZWERK about the patch release. Publication delayed for undisclosed reasons.
- 2026-10-26 Advisory released
Credits
The vulnerability was discovered by Daniel Marner of SCHUTZWERK GmbH.