{"id":"CVE-2026-62277","kind":"vulnerability","aliases":["CVE-2026-62277"],"related":[],"title":"LubeLogger: authenticated users can read other users' vehicle records","description":"LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, `PrintRecordStickers` in `/Controllers/VehicleController.cs` checks through `CollaboratorFilter` that the authenticated caller can view the supplied `vehicleId`, but fetches caller-supplied `recordIds` without checking that each record's `VehicleId` belongs to the authorized vehicle. An authenticated user can submit `POST /Vehicle/PrintRecordStickers` with an authorized `vehicleId`, enumerate other users' integer record IDs and select an `ImportMode` to retrieve records across the service, gas, repair, upgrade, tax, supply, note, odometer, reminder, plan, inspection and equipment stores. Returned information includes descriptions, costs, notes, mileage, extra fields and file attachment metadata, allowing cross-user disclosure of vehicle maintenance records. This issue is fixed in version 1.6.8.","summary":"LubeLogger, a self-hosted vehicle maintenance tracker, checks access to the vehicle in a print-stickers request but not to the record IDs supplied with it. A logged-in user can enumerate integer record IDs belonging to other users and read their costs, notes, mileage and attachment metadata.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dotnet","lubelogger","package","self-hosted"],"not_affected_if":["single-user-install","version-1.6.8-or-later"],"how_to_check":"- Check the installed LubeLogger version; versions before `1.6.8` are affected.\n- Look for the `PrintRecordStickers` action in `/Controllers/VehicleController.cs` and confirm it validates each `recordId` against the vehicle.","fix":"- Move to LubeLogger `1.6.8` or later.","status":"open","published_at":"2026-10-30T22:16:56+00:00","first_seen_at":"2026-10-30T22:25:56+00:00","triaged_at":"2026-10-30T22:27:15+00:00","updated_at":"2026-10-30T22:27:15+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T22:27:15Z","model":"claude-haiku-5-5","output":{"fix":"- Move to LubeLogger `1.6.8` or later.","reach":"network","title":"LubeLogger: authenticated users can read other users' vehicle records","impact":"medium","summary":"LubeLogger, a self-hosted vehicle maintenance tracker, checks access to the vehicle in a print-stickers request but not to the record IDs supplied with it. A logged-in user can enumerate integer record IDs belonging to other users and read their costs, notes, mileage and attachment metadata.","audience":"businesses","category":"package","nicknames":[],"who_cares":["self-hosted","lubelogger","dotnet"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"other users' vehicle maintenance records readable by any logged-in account","analyst_note":"","how_to_check":"- Check the installed LubeLogger version; versions before `1.6.8` are affected.\n- Look for the `PrintRecordStickers` action in `/Controllers/VehicleController.cs` and confirm it validates each `recordId` against the vehicle.","plain_action":"","needs_analyst":false,"not_affected_if":["single-user-install","version-1.6.8-or-later"],"who_is_affected":"Teams that self-host LubeLogger for multiple users or collaborators are exposed, because the flaw lets one authenticated account read records from other accounts. Single-user installs with no other accounts have little to disclose. unknown for whether public or hosted instances are involved.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00071,"input_tokens":4372,"output_tokens":545,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-62277':12A,15A '/controllers/vehiclecontroller.cs':96C '/vehicle/printrecordstickers':133C '1.6.8':93C,195C 'access':31B 'across':151C 'allow':180C 'attach':71B,178C 'authent':2A,102C,128C 'author':125C,136C 'base':84C 'belong':60B,122C 'caller':103C,112C 'caller-suppli':111C 'check':30B,97C,116C 'collaboratorfilt':99C 'cost':67B,171C 'cross':182C 'cross-us':181C 'cve':10A,13A 'descript':170C 'disclosur':184C 'dotnet':16B 'enumer':56B,138C 'equip':165C 'extra':174C 'fetch':110C 'field':175C 'file':177C 'fix':192C 'fuel':88C 'gas':154C 'host':21B,26B,78C 'id':46B,59B,143C 'importmod':147C 'includ':169C 'inform':168C 'inspect':163C 'integ':57B,141C 'issu':190C 'log':52B 'logged-in':51B 'lubelogg':1A,17B,22B,73C 'mainten':28B,86C,187C 'metadata':72B,179C 'mileag':69B,89C,173C 'note':68B,159C,172C 'odomet':160C 'open':80C 'open-sourc':79C 'packag':18B 'plan':162C 'post':132C 'print':38B 'print-stick':37B 'printrecordstick':94C 'prior':91C 'read':5A,65B 'record':9A,45B,58B,119C,142C,150C,188C 'recordid':114C 'remind':161C 'repair':155C 'request':40B 'retriev':149C 'return':167C 'select':145C 'self':20B,25B,77C 'self-host':19B,24B,76C 'servic':153C 'sourc':81C 'sticker':39B 'store':166C 'submit':131C 'suppli':47B,107C,113C,158C 'tax':157C 'tracker':29B,90C 'upgrad':156C 'user':3A,7A,54B,63B,129C,140C,183C 'vehicl':8A,27B,34B,85C,126C,186C 'vehicleid':108C,121C,137C 'version':194C 'view':105C 'web':83C 'web-bas':82C 'without':115C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host LubeLogger for multiple users or collaborators are exposed, because the flaw lets one authenticated account read records from other accounts. Single-user installs with no other accounts have little to disclose. unknown for whether public or hosted instances are involved.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T22:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62277","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62277","severity":null,"published_at":"2026-10-30T22:16:56+00:00","modified_at":"2026-10-30T22:16:56+00:00","first_seen_at":"2026-10-30T22:25:56+00:00","fetched_at":"2026-10-30T22:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}