CVE-2026-3322 Details
Description
Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.
A vulnerability in Lobster_pro has been identified, where improper permission checks allow attackers to access endpoints that should be restricted to administrative users. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3. The vulnerability enables authenticated attackers with non-administrative privileges to replay administrative requests and gain access to sensitive personal data, such as lists of registered users.
Users are advised to update Lobster_pro to version 25.1.3 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.schutzwerk.com/en/blog/schutzwerk-sa-2025-002/ | SCHUTZWERK | AdvisoryRemedy |
| http://seclists.org/fulldisclosure/2026/Oct/35 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-280 | Improper Handling of Insufficient Permissions or Privileges | SCHUTZWERK |
Affected Products
| Product | Versions |
|---|---|
| Lobster DATA GmbH Lobster_pro | 4.12.12-LTS (semver) < 25.1.3 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CVE |
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | SCHUTZWERK |