Improper permission checks in Lobster_pro expose admin endpoints
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Lobster DATA GmbH's Lobster_pro from 4.12.12-LTS before 25.1.3 has improper permission checks (CWE-280). Endpoints that should require administrative privileges can be reached without them. An attacker on the adjacent network with low privileges can reach these endpoints and gain high confidentiality impact. Exploitation requires passive user interaction.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lobster DATA GmbH | Lobster_pro | 4.12.12-LTS | 25.1.3 | Patch available | CNA |
- Lobster_pro VendorLobster DATA GmbH Affected 4.12.12-LTS Fixed in 25.1.3 Patch available CNA
Remediation
Lobster DATA GmbH lists Lobster_pro version 25.1.3 as the fixed version. Upgrade Lobster_pro to 25.1.3 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Lobster_pro (Lobster DATA GmbH) Fixed in 25.1.3
Timeline
- 2026-10-26 Threatist record created from CVE-2026-3322
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-26 Priority changed: MEDIUM → LOW
- 2026-10-27 Alias added: GHSA-7fg6-gvjw-377p
References
Sources
- CVE-2026-3322 · CVE Program
- CVE-2026-3322 · NVD
- FIRST EPSS
- GHSA-7fg6-gvjw-377p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences