---
id: "CVE-2026-62277"
kind: "vulnerability"
aliases: ["CVE-2026-62277"]
title: "LubeLogger: authenticated users can read other users' vehicle records"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dotnet", "lubelogger", "package", "self-hosted"]
not_affected_if: ["single-user-install", "version-1.6.8-or-later"]
published_at: "2026-10-30T22:16:56+00:00"
first_seen_at: "2026-10-30T22:25:56+00:00"
updated_at: "2026-10-30T22:27:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62277", "first_seen_at": "2026-10-30T22:25:56+00:00"}]
---

# LubeLogger: authenticated users can read other users' vehicle records

LubeLogger, a self-hosted vehicle maintenance tracker, checks access to the vehicle in a print-stickers request but not to the record IDs supplied with it. A logged-in user can enumerate integer record IDs belonging to other users and read their costs, notes, mileage and attachment metadata.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed LubeLogger version; versions before `1.6.8` are affected.
- Look for the `PrintRecordStickers` action in `/Controllers/VehicleController.cs` and confirm it validates each `recordId` against the vehicle.

## Fix

- Move to LubeLogger `1.6.8` or later.

## Timeline

- 2026-10-30T22:25:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62277

## From the sources

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, `PrintRecordStickers` in `/Controllers/VehicleController.cs` checks through `CollaboratorFilter` that the authenticated caller can view the supplied `vehicleId`, but fetches caller-supplied `recordIds` without checking that each record's `VehicleId` belongs to the authorized vehicle. An authenticated user can submit `POST /Vehicle/PrintRecordStickers` with an authorized `vehicleId`, enumerate other users' integer record IDs and select an `ImportMode` to retrieve records across the service, gas, repair, upgrade, tax, supply, note, odometer, reminder, plan, inspection and equipment stores. Returned information includes descriptions, costs, notes, mileage, extra fields and file attachment metadata, allowing cross-user disclosure of vehicle maintenance records. This issue is fixed in version 1.6.8.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_