CVE-2026-62279

Name of the Vulnerable Software and Affected Versions LubeLogger versions prior to 1.6.8

Description An authenticated user can exploit a missing authorization check in the DuplicateRecordsToOtherVehicles endpoint. While the system verifies the destination vehicles, it fails to call the UserCanEditVehicle() function for each existingRecord.VehicleId when fetching source records in Controllers/VehicleController.cs. This allows an attacker to copy service, collision, upgrade, fuel, tax, supply, note, odometer, reminder, plan, inspection, and equipment records belonging to other users into a vehicle they control, exposing record contents and attachment paths.

Recommendations Update to version 1.6.8.