CVE-2026-62277: LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration

Published Oct 30, 2026

Updated

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, PrintRecordStickers in /Controllers/VehicleController.cs checks through CollaboratorFilter that the authenticated caller can view the supplied vehicleId, but fetches caller-supplied recordIds without checking that each record's VehicleId belongs to the authorized vehicle. An authenticated user can submit POST /Vehicle/PrintRecordStickers with an authorized vehicleId, enumerate other users' integer record IDs and select an ImportMode to retrieve records across the service, gas, repair, upgrade, tax, supply, note, odometer, reminder, plan, inspection and equipment stores. Returned information includes descriptions, costs, notes, mileage, extra fields and file attachment metadata, allowing cross-user disclosure of vehicle maintenance records. This issue is fixed in version 1.6.8.

Event History

Oct 30, 2026

CVE Published

via MITRE·10:06 PM

Data Sourced

via MITRE·10:06 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

LubeLogger versions prior to 1.6.8 are affected. The vulnerable endpoint is part of the web application and exposes records stored across multiple vehicle-maintenance record types.

What does an attacker need to exploit this issue?

An attacker needs an authenticated LubeLogger account and access to at least one vehicle they are authorized to view. They can submit that authorized vehicleId alongside guessed or enumerated integer record IDs belonging to other users.

What information can be disclosed?

The endpoint can return cross-user service, gas, repair, upgrade, tax, supply, note, odometer, reminder, plan, inspection, and equipment records. Disclosed data may include descriptions, costs, notes, mileage, extra fields, and file attachment metadata.

What should teams do if they cannot patch immediately?

The provided information identifies no workaround. Until upgrading to 1.6.8, restrict access to authenticated users who must use the application and treat records accessible through this endpoint as potentially exposed to other authenticated users.

How can defenders identify attempted exploitation?

Review requests to POST /Vehicle/PrintRecordStickers for authorized vehicleId values paired with recordIds that do not belong to that vehicle, particularly repeated or sequential record ID requests and changes to ImportMode.

CVE-2026-62277: LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What information can be disclosed?

What should teams do if they cannot patch immediately?

How can defenders identify attempted exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What information can be disclosed?

What should teams do if they cannot patch immediately?

How can defenders identify attempted exploitation?