Lobster_pro privilege escalation via request replaying
Original title: SCHUTZWERK-SA-2025-002: Privilege escalation in Lobster_pro through request replaying
Improper permission checks let attackers call admin-only endpoints; 4.12.12-LTS and builds before 25.1.3 are cited.
SCHUTZWERK advisory SCHUTZWERK-SA-2025-002 describes privilege escalation in Lobster_pro through request replaying. Improper permission checks let attackers interact with endpoints that should require administrative privileges. The issue affects version 4.12.12-LTS and potentially other versions prior to 25.1.3.
Unconfirmed: The advisory says other versions prior to 25.1.3 are only potentially affected.
- Advisory ID is SCHUTZWERK-SA-2025-002.
- Confirmed affected build named is 4.12.12-LTS.
- Other versions prior to 25.1.3 are described as potentially affected.
- Posted by David Brown via Full Disclosure on October 27.
Impact: Privilege escalation to administrative endpoints
| Product | Affected | Fixed in |
|---|---|---|
| Lobster_pro | 4.12.12-LTS and potentially other versions prior to 25.1.3 | 25.1.3 |
- 1.Upgrade Lobster_pro to 25.1.3 or later.
- Products
- Lobster_pro
- Organizations
- SCHUTZWERK
From the original article
Posted by David Brown via Fulldisclosure on Oct 27 Privilege escalation via request replaying in Lobster_pro ========================================================= Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4. 12.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.