CVE-2026-62279

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user could submit caller-controlled recordIds to the DuplicateRecordsToOtherVehicles endpoint while naming destination vehicleIds the user could edit. The endpoint authorized the destination vehicles but fetched source records in Controllers/VehicleController.cs without checking UserCanEditVehicle for each existingRecord.VehicleId. This missing source-vehicle authorization allowed service, collision, upgrade, fuel, tax, supply, note, odometer, reminder, plan, inspection, and equipment records belonging to another user to be copied into an attacker-controlled vehicle, exposing record contents and attachment paths and creating persistent copies. This issue is fixed in version 1.6.8.

• CWE-639

• https://github.com/hargata/lubelog/commit/c8d5888ebc69e6a163e33f36200233ec845e5c57
• https://github.com/hargata/lubelog/issues/1398
• https://github.com/hargata/lubelog/pull/1395
• https://github.com/hargata/lubelog/releases/tag/v1.6.8
• https://github.com/hargata/lubelog/security/advisories/GHSA-3r34-mx83-q67r

Published

Sep 18, 2026

Last Modified

Sep 24, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6225The Taskbuilder – Project Management & Task Management Tool …6.5
• CVE-2026-6226The Frontend Admin by DynamiApps plugin for WordPress is vul…8.8
• CVE-2026-62262Piwigo is a full featured open source photo gallery applicat…9.1
• CVE-2026-62263Open Access Management (OpenAM) is an access management solu…9.2
• CVE-2026-6227The BackWPup plugin for WordPress is vulnerable to Local Fil…7.2
• CVE-2026-62278LubeLogger is a self-hosted, open-source, web-based vehicle …8.1
• CVE-2026-6228The Frontend Admin by DynamiApps plugin for WordPress is vul…8.8
• CVE-2026-62280Open Access Management (OpenAM) is an access management solu…6.1
• CVE-2026-62282OpenCVE is a vulnerability intelligence platform. Prior to 3…6.5
• CVE-2026-62283Nezha Monitoring is a self-hostable, lightweight, servers an…9.9
• CVE-2026-62286Dozzle is a realtime log viewer for docker containers. Prior…4.3
• CVE-2026-62287Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…