CVE-2026-62279: LubeLogger: IDOR in DuplicateRecordsToOtherVehicles Allows Copying Records from Any User's Vehicle Without Ownership Check
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user could submit caller-controlled recordIds to the DuplicateRecordsToOtherVehicles endpoint while naming destination vehicleIds the user could edit. The endpoint authorized the destination vehicles but fetched source records in Controllers/VehicleController.cs without checking UserCanEditVehicle for each existingRecord.VehicleId. This missing source-vehicle authorization allowed service, collision, upgrade, fuel, tax, supply, note, odometer, reminder, plan, inspection, and equipment records belonging to another user to be copied into an attacker-controlled vehicle, exposing record contents and attachment paths and creating persistent copies. This issue is fixed in version 1.6.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LubeLoggerto a version that resolves this vulnerability.Fixed in 1.6.8 - Operational
After upgrading to 1.6.8, review and remove any attacker-created duplicate vehicle records (service, collision, upgrade, fuel, tax, supply, note, odometer, reminder, plan, inspection, and equipment records) created via the DuplicateRecordsToOtherVehicles endpoint, and investigate whether attachment paths/record contents were exposed.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated LubeLogger user who can edit at least one destination vehicle can exploit it. The attacker can supply record IDs for source records from vehicles they do not own or otherwise have permission to edit.
What information can be exposed or copied?
An attacker can copy service, collision, upgrade, fuel, tax, supply, note, odometer, reminder, plan, inspection, and equipment records into a vehicle they control. The copied data can expose record contents and attachment paths, and the copies persist in the attacker's destination vehicle.
Are deployments affected by default?
Affected versions prior to 1.6.8 are vulnerable when multiple users have authenticated access and an attacker can edit a vehicle. Exploitation does not require user interaction beyond the attacker's authenticated access.
What should be done if an upgrade cannot happen immediately?
The provided information identifies version 1.6.8 as the fix but does not specify a workaround. Until upgrading, restrict access to trusted users and review whether untrusted authenticated users can edit vehicles.
How can administrators assess possible impact?
Review record duplication activity for copies appearing in vehicles controlled by users who should not have access to the source vehicle records. Pay particular attention to copied records and attachment paths originating from vehicles owned by different users.