Improper Access Control in LubeLogger Web-Based Vehicle Tracker
CVE-2026-62277

6.5MEDIUM

Key Information:

Vendor

Hargata

Status
Lubelog
Vendor
CVE Published:
30 October 2026

What is CVE-2026-62277?

LubeLogger, a self-hosted vehicle maintenance and fuel mileage tracking service, has been identified with an improper access control vulnerability prior to version 1.6.8. In the PrintRecordStickers functionality, it fails to adequately verify that the authenticated user requesting specific vehicle records has permissions associated with those records. This lack of validation allows users to manipulate record requests, potentially exposing sensitive vehicle maintenance data across various user accounts. The vulnerability permits unauthorized access to records containing information such as service history, costs, and other critical notes. The issue has been rectified in version 1.6.8.

Affected Version(s)

lubelog < 1.6.8

References

https://github.com/hargata/lubelog/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/hargata/lubelog/commit/c8d5888ebc69e6a...
x_refsource_MISC
https://github.com/hargata/lubelog/releases/tag/v1.6.8
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.