Live › vulnerability › CVE-2026-62277
LubeLogger, a self-hosted vehicle maintenance tracker, checks access to the vehicle in a print-stickers request but not to the record IDs supplied with it. A logged-in user can enumerate integer record IDs belonging to other users and read their costs, notes, mileage and attachment metadata.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 22:25 UTC. All times on this page are UTC.
Teams that self-host LubeLogger for multiple users or collaborators are exposed, because the flaw lets one authenticated account read records from other accounts. Single-user installs with no other accounts have little to disclose. unknown for whether public or hosted instances are involved.
No product ranges from the sources yet.
1.6.8 are affected.PrintRecordStickers action in /Controllers/VehicleController.cs and confirm it validates each recordId against the vehicle.1.6.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, PrintRecordStickers in /Controllers/VehicleController.cs checks through CollaboratorFilter that the authenticated caller can view the supplied vehicleId, but fetches caller-supplied recordIds without checking that each record's VehicleId belongs to the authorized vehicle. An authenticated user can submit POST /Vehicle/PrintRecordStickers with an authorized vehicleId, enumerate other users' integer record IDs and select an ImportMode to retrieve records across the service, gas, repair, upgrade, tax, supply, note, odometer, reminder, plan, inspection and equipment stores. Returned information includes descriptions, costs, notes, mileage, extra fields and file attachment metadata, allowing cross-user disclosure of vehicle maintenance records. This issue is fixed in version 1.6.8.
This page as .md · .json · in your agent: get_signal("CVE-2026-62277")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.