CVE-2026-3322
Received Received - Intake

Improper Permission Check in Lobster_pro

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: SCHUTZWERK

Description
Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-3322
EUVD
EUVD-2026-109944

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Lobster DATA GmbH Lobster_pro 4.12.12-LTS

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-280 The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-3322 is a privilege escalation vulnerability in Lobster_pro, an application by Lobster DATA GmbH. It occurs due to improper permission checks that allow attackers with non-administrative privileges to replay administrative requests and gain unauthorized access to sensitive data.

Detection Guidance

To detect this vulnerability, monitor HTTP requests for improper use of administrative headers like X-Env-Clientid and X-Env-Sessiontoken by non-admin users. Check Lobster_pro logs for unauthorized access attempts or requests to sensitive endpoints.

Impact Analysis

This vulnerability allows authenticated attackers to manipulate specific headers in their session to perform actions reserved for administrators, such as retrieving a list of registered users. This could lead to exposure of personal data and potential unauthorized actions depending on the information stored in the system.

Mitigation Strategies

Immediately update Lobster_pro to version 25.1.3 or later. Ensure all users are authenticated and restrict access to administrative endpoints. Review logs for suspicious activity and revoke any unauthorized sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3322. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart