CVE-2026-62277

Received Received - Intake

Unauthorized Data Exposure in LubeLogger Vehicle Maintenance System

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, `PrintRecordStickers` in `/Controllers/VehicleController.cs` checks through `CollaboratorFilter` that the authenticated caller can view the supplied `vehicleId`, but fetches caller-supplied `recordIds` without checking that each record's `VehicleId` belongs to the authorized vehicle. An authenticated user can submit `POST /Vehicle/PrintRecordStickers` with an authorized `vehicleId`, enumerate other users' integer record IDs and select an `ImportMode` to retrieve records across the service, gas, repair, upgrade, tax, supply, note, odometer, reminder, plan, inspection and equipment stores. Returned information includes descriptions, costs, notes, mileage, extra fields and file attachment metadata, allowing cross-user disclosure of vehicle maintenance records. This issue is fixed in version 1.6.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-62277

Affected Vendors & Products

Vendor	Product	Version / Range
hargata	lubelog	< 1.6.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

LubeLogger is a vehicle maintenance tracker. Before version 1.6.8, an authenticated user could exploit a flaw in the PrintRecordStickers function to access other users' vehicle maintenance records by submitting a specially crafted request. The system checked if the user could view a vehicle but failed to verify if the requested records belonged to that vehicle.

Detection Guidance

This vulnerability can be detected by checking the LubeLogger version. If your system is running a version prior to 1.6.8, it is vulnerable. Review logs for unusual POST requests to /Vehicle/PrintRecordStickers with multiple record IDs.

Impact Analysis

If you use LubeLogger before version 1.6.8, an attacker with access could view your vehicle's maintenance records, including descriptions, costs, notes, mileage, and file attachments. This could expose sensitive information about your vehicle usage and maintenance history.

Compliance Impact

This vulnerability could lead to unauthorized access to personal and sensitive data, potentially violating privacy regulations like GDPR or HIPAA. It enables cross-user disclosure of vehicle maintenance records, which may contain personally identifiable information.

Mitigation Strategies

Upgrade LubeLogger to version 1.6.8 or later immediately. Review and restrict access to the /Vehicle/PrintRecordStickers endpoint. Monitor logs for suspicious activity involving record ID enumeration.

Hi! I’m here to help you understand CVE-2026-62277. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70