Unauthorized Record Access in LubeLogger Vehicle Maintenance Tracker
CVE-2026-62279

7.1HIGH

Key Information:

Vendor

Hargata

Status
Lubelog
Vendor
CVE Published:
18 September 2026

What is CVE-2026-62279?

LubeLogger, a self-hosted vehicle maintenance and fuel mileage tracker, is susceptible to a vulnerability that allows authenticated users to exploit the DuplicateRecordsToOtherVehicles endpoint. The flaw occurs because the system fails to authorize the source vehicle records properly, leading to unauthorized access to sensitive user records. An attacker can manipulate recordIds and obtain information related to service, collision, upgrade, and other records from another user's account. This issue was addressed in version 1.6.8, highlighting the importance of robust user authorization checks.

Affected Version(s)

lubelog < 1.6.8

References

https://github.com/hargata/lubelog/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/hargata/lubelog/issues/1398
x_refsource_MISC
https://github.com/hargata/lubelog/pull/1395
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.