CVE-2026-62277

Name of the Vulnerable Software and Affected Versions LubeLogger versions prior to 1.6.8

Description An authenticated user can cause cross-user disclosure of vehicle maintenance records. The PrintRecordStickers() function in /Controllers/VehicleController.cs verifies if the caller can view the provided vehicleId via CollaboratorFilter, but it fails to verify that the supplied recordIds belong to that authorized vehicle. By sending a request to the endpoint "/Vehicle/PrintRecordStickers" with a valid vehicleId and enumerating other users' integer recordIds, an attacker can retrieve data from various stores, including service, gas, repair, upgrade, tax, supply, note, odometer, reminder, plan, inspection, and equipment. The leaked information includes descriptions, costs, notes, mileage, extra fields, and file attachment metadata.

Recommendations Update LubeLogger to version 1.6.8.