Lobster_pro EUVD-2026-109944

Exploitation requires a valid low-privilege authenticated account on the Lobster_pro instance (PR:L) and adjacent-network access (AV:A) to reach the HTTP endpoints; the attacker then interacts with endpoints that should require administrative privileges but whose permission checks are not enforced (CWE-280). Confirmed affected: Lobster_pro 4.12.12-LTS, with other versions prior to 25.1.3 potentially affected. Limiting factors: the attacker must already hold credentials and network adjacency rather than attacking an unauthenticated internet-facing surface, and impact is restricted to confidentiality/information disclosure with no integrity or availability effect. The specific administrative endpoints involved and the precise trigger are not detailed in the available sources.

This is a medium-severity issue (CVSS 4.0 base 5.6) and, weighing all signals together, a moderate real-world priority rather than an emergency. The CVSS 4.0 vector describes adjacent-network access (AV:A), low attack complexity (AC:L), a low-privilege authenticated attacker (PR:L), and confidentiality-only impact on both the vulnerable and a subsequent system (VC:H/SC:H, with VI/VA/SI/SA all N) - consistent with the CWE-280 improper-authorization class and the 'Information Disclosure' tag. The vendor/researcher vector carries the threat metric E:A ('Attacked'), which would imply exploitation activity, but this is NOT corroborated by a CISA KEV listing and no EPSS probability was supplied, so the E:A signal cannot be confirmed and should be treated cautiously - it conflicts with the absence of KEV/EPSS data. The vuln.today decision label is 'this_month', indicating it warrants remediation within the normal patching cycle rather than immediate emergency action. Net assessment: the requirement for a pre-existing authenticated account plus network adjacency, combined with confidentiality-only impact, meaningfully limits real-world risk; this is a genuine broken-access-control flaw worth patching this month, not a high-urgency internet-wide threat.

A low-privilege but authenticated user on a network adjacent to a Lobster_pro instance sends requests directly to endpoints that are supposed to be restricted to administrators. Because Lobster_pro does not properly enforce permission checks, those endpoints respond, exposing administrative data or functionality and disclosing sensitive information. No verified working public exploit code was identified; a researcher advisory (SCHUTZWERK) documents the issue.