Vulnerability · Published Oct 30, 2026 · Assigned by GitHub_M

CVE-2026-62277LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in lubelog from hargata. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 75.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, `PrintRecordStickers` in `/Controllers/VehicleController.cs` checks through `CollaboratorFilter` that the authenticated caller can view the supplied `vehicleId`, but fetches caller-supplied `recordIds` without checking that each record's `VehicleId` belongs to the authorized vehicle. An authenticated user can submit `POST /Vehicle/PrintRecordStickers` with an authorized `vehicleId`, enumerate other users' integer record IDs and select an `ImportMode` to retrieve records across the service, gas, repair, upgrade, tax, supply, note, odometer, reminder, plan, inspection and equipment stores. Returned information includes descriptions, costs, notes, mileage, extra fields and file attachment metadata, allowing cross-user disclosure of vehicle maintenance records. This issue is fixed in version 1.6.8.

Affected products (as reported)

Vendor	Product	Versions
hargata	lubelog	< 1.6.8

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/hargata/lubelog/security/advisories/GHSA-8j7x-38m5-84xj x_refsource_CONFIRM
https://github.com/hargata/lubelog/commit/c8d5888ebc69e6a163e33f36200233ec845e5c57 x_refsource_MISC
https://github.com/hargata/lubelog/releases/tag/v1.6.8 x_refsource_MISC