GCVE-1988-2026-0464

Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30
VLAI
Title
SCHUTZWERK-SA-2025-002: Privilege escalation in Lobster_pro through request replaying
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Privilege escalation via request replaying in Lobster_pro ========================================================= version 4.12.12-LTS and potentially other versions prior to 25.1.3. Metadata ======== - - Affected product: Lobster_pro - - Vendor: Lobster DATA GmbH - - CVE ID: CVE-2026-3322 - - CVE URL: https://www.cve.org/CVERecord?id=CVE-2026-3322 - - CVSS 4.0 score: 5.6 - - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2025-002/ Details ======= Risk ==== information stored in Lobster_pro. Solution/Mitigation =================== Update Lobster_pro to version 25.1.3 or later. Timeline ======== - - 2025-06-26 Vulnerability reported to vendor - - 2025-10-09 Vendor releases version 25.0.1 to address the vulnerability - - 2025-11-19 Vendor releases version 25.1.3 with additional fixes undisclosed reasons. - - 2026-10-26 Advisory released Credits ======= The vulnerability was discovered by Daniel Marner of SCHUTZWERK GmbH. Footnotes ========= [0] https://en.wikipedia.org/wiki/Action_Message_Format -----BEGIN PGP SIGNATURE----- iQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmrfZz0aHGFkdmlzb3Jp ZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrsQ9g/+MUYMsmoaxs5JxKD5Obas SIbfHKCwSutmpE1Q8j0Ao5oG3IR9Zo0SgFhFFPelH5E7Q6lf2C0YbretCMvxCFXx Ybg5VX9OFQFazRDP/9mx9LaT+ZSwBFLMnlPDM5Pwudn7xoNEoVmRbNIibwVhhzqB U2Hmd0gHfUZbhtA95lCm6ODKBFxqV1MP/LRYbVM8Qp6BBT0V357VsVfUwAcNyKdo ObmuXRA9p2iuElF67DwjAvLYNzU4C2/eUjLw9T9pJhKNs+hBh7hYFi6UefWOQ1MI bNTMA9Ngw42Jed/Be69un9Fw0D+09CWx/PmXbcVnvEhpLLA846bbJ27uWJvuFn4t waKpNx9uka2TRaFsF20VE3Wa+EaCT2OajFcZVXy+KOK4ZMNyeACStc0SI6kLOFIZ MgvFc+GWq48DIJvAugt0d16O5tQcD/+rSt0RP/jV++hTUAeIUKEPjarJi4j+wkpj QhDUBhl+R5cgmOr43bPhwYYUnd9uJMHa6p0X+54vnJPhv2zkDPRbJCMrNHkK4giK Vc8F+Kvl6B4r0gbVKY5jD48Ups8tOLaX1S2KkixlwZf7vKQw4gIlJPMEPZt9dEaS 8K59OYPiIIe7prOk2nbZQjGQ344lezd9rEdV3UZgucRSRnnJb7sCX6hVC7K4DSeS 5wvZd03jEsRq4o+PWaKo9wg= =vwsA -----END PGP SIGNATURE----- -- SCHUTZWERK GmbH, Pfarrer-Weiß-Weg 12, 89077 Ulm, Germany Zertifiziert / Certified ISO 27001, 9001 and TISAX Phone +49 731 977 191 0 advisories () schutzwerk com / www.schutzwerk.com Geschäftsführer / Managing Directors: Jakob Pietzka, Michael Schäfer Amtsgericht Ulm / HRB 727391 Datenschutz / Data Protection www.schutzwerk.com/datenschutz _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 551 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
unknown SCHUTZWERK-SA-2025-002 Privilege escalation Affected: unknown
guessed Create a notification for this product.
Credits
David Brown via Fulldisclosure
Relationships
reference GCVE-1988-2026-0464 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SCHUTZWERK-SA-2025-002 Privilege escalation",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "David Brown via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\nPrivilege escalation via request replaying in Lobster_pro\n=========================================================\n\n\nversion 4.12.12-LTS and potentially other versions prior to 25.1.3.\n\nMetadata\n========\n\n- - Affected product: Lobster_pro\n\n- - Vendor: Lobster DATA GmbH\n\n- - CVE ID: CVE-2026-3322\n- - CVE URL: https://www.cve.org/CVERecord?id=CVE-2026-3322\n- - CVSS 4.0 score: 5.6\n- - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2025-002/\n\nDetails\n=======\n\n\n\nRisk\n====\n\n\ninformation stored in Lobster_pro.\n\nSolution/Mitigation\n===================\n\nUpdate\u00a0Lobster_pro\u00a0to version\u00a025.1.3 or\u00a0later.\n\nTimeline\n========\n\n- - 2025-06-26 Vulnerability reported to vendor\n- - 2025-10-09 Vendor releases version 25.0.1 to address the vulnerability\n- - 2025-11-19 Vendor releases version 25.1.3 with additional fixes\n\n  undisclosed reasons.\n- - 2026-10-26 Advisory released\n\nCredits\n=======\n\nThe vulnerability was discovered by Daniel Marner of SCHUTZWERK GmbH.\n\nFootnotes\n=========\n\n[0] https://en.wikipedia.org/wiki/Action_Message_Format\n-----BEGIN PGP SIGNATURE-----\n\niQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmrfZz0aHGFkdmlzb3Jp\nZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrsQ9g/+MUYMsmoaxs5JxKD5Obas\nSIbfHKCwSutmpE1Q8j0Ao5oG3IR9Zo0SgFhFFPelH5E7Q6lf2C0YbretCMvxCFXx\nYbg5VX9OFQFazRDP/9mx9LaT+ZSwBFLMnlPDM5Pwudn7xoNEoVmRbNIibwVhhzqB\nU2Hmd0gHfUZbhtA95lCm6ODKBFxqV1MP/LRYbVM8Qp6BBT0V357VsVfUwAcNyKdo\nObmuXRA9p2iuElF67DwjAvLYNzU4C2/eUjLw9T9pJhKNs+hBh7hYFi6UefWOQ1MI\nbNTMA9Ngw42Jed/Be69un9Fw0D+09CWx/PmXbcVnvEhpLLA846bbJ27uWJvuFn4t\nwaKpNx9uka2TRaFsF20VE3Wa+EaCT2OajFcZVXy+KOK4ZMNyeACStc0SI6kLOFIZ\nMgvFc+GWq48DIJvAugt0d16O5tQcD/+rSt0RP/jV++hTUAeIUKEPjarJi4j+wkpj\nQhDUBhl+R5cgmOr43bPhwYYUnd9uJMHa6p0X+54vnJPhv2zkDPRbJCMrNHkK4giK\nVc8F+Kvl6B4r0gbVKY5jD48Ups8tOLaX1S2KkixlwZf7vKQw4gIlJPMEPZt9dEaS\n8K59OYPiIIe7prOk2nbZQjGQ344lezd9rEdV3UZgucRSRnnJb7sCX6hVC7K4DSeS\n5wvZd03jEsRq4o+PWaKo9wg=\n=vwsA\n-----END PGP SIGNATURE-----\n\n\n\n--\nSCHUTZWERK GmbH, Pfarrer-Wei\u00df-Weg 12, 89077 Ulm, Germany\nZertifiziert / Certified ISO 27001, 9001 and TISAX\n\nPhone +49 731 977 191 0\n\nadvisories () schutzwerk com / www.schutzwerk.com\n\nGesch\u00e4ftsf\u00fchrer / Managing Directors:\nJakob Pietzka, Michael Sch\u00e4fer\n\nAmtsgericht Ulm /  HRB 727391\nDatenschutz / Data Protection www.schutzwerk.com/datenschutz\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T07:30:00Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/35"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Oct/35"
        },
        {
          "url": "https://en.wikipedia.org/wiki/Action_Message_Format"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3322"
        },
        {
          "url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2025-002/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Oct/35"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SCHUTZWERK-SA-2025-002: Privilege escalation in Lobster_pro through request replaying",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-3322",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0464",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/35",
            "automated": true,
            "contentSha256": "7665b42e98f88b17421d4d7687e1968a1886b1eb0ef1f2d0a6da78645643cb73",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/35",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-10-26T14:46:40Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0464"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-02T07:30:00Z",
    "dateUpdated": "2026-11-02T07:30:00Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0464"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.