Lobster_pro 4.12.12-LTS Token Replay / Privilege Escalation

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Privilege escalation via request replaying in Lobster_pro
=========================================================

Due to improper permission checks in Lobster_pro, attackers are able to 
interact with
endpoints that should require administrative privileges. This issue 
affects Lobster_pro
version 4.12.12-LTS and potentially other versions prior to 25.1.3.

Metadata
========

- - Affected product: Lobster_pro
- - Affected version: 4.12.12-LTS and potentially other versions prior 
to 25.1.3
- - Vendor: Lobster DATA GmbH
- - Problem type(s): CWE-280 Improper handling of insufficient 
permissions or privileges
- - CVE ID: CVE-2026-3322
- - CVE URL: https://www.cve.org/CVERecord?id=CVE-2026-3322
- - CVSS 4.0 score: 5.6
- - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2025-002/

Details
=======

The endpoint https://lobster-pro-instance:443/BASE/user/search/tuple 
allows administrators
to retrieve the list of registered users for editing. Authenticated 
attackers with
non-administrative privileges who have access to an administrative 
request can replay the
request with their own session ID and gain access to personal data. 
Attackers only need to
replace the headers X-Env-Clientid and X-Env-Sessiontoken with the 
values of their own
unprivileged session. Similar attacks are likely possible by manually 
forging the correct
Action Message Format[0] request data instead of intercepting an 
administrative request.

Risk
====

An attacker can use this vulnerability to download a list of registered 
users or
potentially perform other unauthorized actions. The amount of data 
exposed depends on the
information stored in Lobster_pro.

Solution/Mitigation
===================

Update Lobster_pro to version 25.1.3 or later.

Timeline
========

- - 2025-06-26 Vulnerability reported to vendor
- - 2025-10-09 Vendor releases version 25.0.1 to address the vulnerability
- - 2025-11-19 Vendor releases version 25.1.3 with additional fixes
- - 2025-11-19 Vendor informs SCHUTZWERK about the patch release. 
Publication delayed for
  undisclosed reasons.
- - 2026-10-26 Advisory released

Credits
=======

The vulnerability was discovered by Daniel Marner of SCHUTZWERK GmbH.

Footnotes
=========

[0] https://en.wikipedia.org/wiki/Action_Message_Format
-----BEGIN PGP SIGNATURE-----

iQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmrfZz0aHGFkdmlzb3Jp
ZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrsQ9g/+MUYMsmoaxs5JxKD5Obas
SIbfHKCwSutmpE1Q8j0Ao5oG3IR9Zo0SgFhFFPelH5E7Q6lf2C0YbretCMvxCFXx
Ybg5VX9OFQFazRDP/9mx9LaT+ZSwBFLMnlPDM5Pwudn7xoNEoVmRbNIibwVhhzqB
U2Hmd0gHfUZbhtA95lCm6ODKBFxqV1MP/LRYbVM8Qp6BBT0V357VsVfUwAcNyKdo
ObmuXRA9p2iuElF67DwjAvLYNzU4C2/eUjLw9T9pJhKNs+hBh7hYFi6UefWOQ1MI
bNTMA9Ngw42Jed/Be69un9Fw0D+09CWx/PmXbcVnvEhpLLA846bbJ27uWJvuFn4t
waKpNx9uka2TRaFsF20VE3Wa+EaCT2OajFcZVXy+KOK4ZMNyeACStc0SI6kLOFIZ
MgvFc+GWq48DIJvAugt0d16O5tQcD/+rSt0RP/jV++hTUAeIUKEPjarJi4j+wkpj
QhDUBhl+R5cgmOr43bPhwYYUnd9uJMHa6p0X+54vnJPhv2zkDPRbJCMrNHkK4giK
Vc8F+Kvl6B4r0gbVKY5jD48Ups8tOLaX1S2KkixlwZf7vKQw4gIlJPMEPZt9dEaS
8K59OYPiIIe7prOk2nbZQjGQ344lezd9rEdV3UZgucRSRnnJb7sCX6hVC7K4DSeS
5wvZd03jEsRq4o+PWaKo9wg=
=vwsA
-----END PGP SIGNATURE-----



-- 
SCHUTZWERK GmbH, Pfarrer-Weiß-Weg 12, 89077 Ulm, Germany
Zertifiziert / Certified ISO 27001, 9001 and TISAX

Phone +49 731 977 191 0

[email protected] / www.schutzwerk.com

Geschäftsführer / Managing Directors:
Jakob Pietzka, Michael Schäfer

Amtsgericht Ulm /  HRB 727391
Datenschutz / Data Protection www.schutzwerk.com/datenschutz