Improper permission checks in Lobster_pro allow attackers to interact with endpoints that should be restricted to administrative users, enabling a privilege escalation scenario. The weakness identified is CWE-280, which concerns improper privilege enforcement. Attackers can exploit this by replaying requests to gain higher privileges, compromising confidentiality, integrity, or availability of the affected system. The vulnerability exists in versions up to at least 25.1.3, including 4.12.12-LTS, and potentially older releases.

The affected product is Lobster_pro from Lobster DATA GmbH. Versions 4.12.12-LTS and all releases prior to 25.1.3 are impacted. No precise patch level is noted beyond the recommendation to upgrade to 25.1.3 or later.

The CVSS score for this issue is 5.6, placing it in the medium severity range. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is request replaying against endpoints that enforce administrative privileges, implying that authenticated users with generic access who can observe or capture legitimate requests may elevate their privileges. No additional exploitation prerequisites are documented, so the risk is primarily mitigated by restricting access to privileged endpoints or applying the vendor patch.