CVE-2026-62279: LubeLogger Auth Bypass Vulnerability

CVE-2026-62279 Overview

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. CVE-2026-62279 describes an Insecure Direct Object Reference (IDOR) flaw in versions prior to 1.6.8. An authenticated user can submit caller-controlled recordIds to the DuplicateRecordsToOtherVehicles endpoint while naming destination vehicleIds the user can edit. The endpoint authorizes destination vehicles but fails to check source-vehicle ownership, allowing cross-tenant record copying. The issue is fixed in version 1.6.8.

Critical Impact

Authenticated attackers can copy service, collision, upgrade, fuel, tax, supply, note, odometer, reminder, plan, inspection, and equipment records belonging to other users into their own vehicle, exposing record contents and attachment paths.

Affected Products

• LubeLogger versions prior to 1.6.8
• Self-hosted LubeLogger multi-user deployments
• LubeLogger Controllers/VehicleController.csDuplicateRecordsToOtherVehicles endpoint

Discovery Timeline

• 2026-09-18 - CVE-2026-62279 published to NVD
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-62279

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference [CWE-639] in the DuplicateRecordsToOtherVehicles endpoint of LubeLogger. The endpoint accepts two user-controlled inputs: a list of source recordIds and a list of destination vehicleIds. The server enforces authorization on the destination vehicles by verifying the caller can edit them. It does not perform the equivalent check on the source records.

As a result, any authenticated user can enumerate or guess record identifiers belonging to other tenants and duplicate them into a vehicle they control. The copied records include service history, fuel entries, tax records, notes, odometer readings, reminders, inspections, and equipment metadata. Attachment file paths are also exposed through the copied records, enabling secondary data access.

Because the copy operation creates persistent database rows in the attacker's account, the disclosure is durable and survives revocation of the original owner's session.

Root Cause

The root cause is a missing source-vehicle authorization check inside Controllers/VehicleController.cs. The code path fetches each existingRecord by recordId and iterates over the destination vehicles, invoking UserCanEditVehicle only on the destination side. There is no equivalent call verifying that the caller has permission on existingRecord.VehicleId before reading and copying the record.

Attack Vector

Exploitation requires only a low-privileged authenticated account. An attacker submits a crafted POST request to the DuplicateRecordsToOtherVehicles endpoint containing arbitrary recordIds (belonging to victim vehicles) and destination vehicleIds under their own control. The server copies the referenced records into the attacker's vehicle, where their full contents and attachment paths become visible in the standard UI.

// Patch excerpt from Controllers/FilesController.cs (v1.6.8)
             var fileName = UploadFile(file);
             return Json(fileName);
         }
-
+        [Authorize(Roles = nameof(UserData.IsRootUser))]
         [HttpPost]
         public IActionResult HandleTranslationFileUpload(IFormFile file)
         {
// Source: https://github.com/hargata/lubelog/commit/c8d5888ebc69e6a163e33f36200233ec845e5c57

// Patch excerpt from Helper/FileHelper.cs (v1.6.8) — related path traversal hardening
                 {
                     var originalFileName = Path.GetFileNameWithoutExtension(fullFilePath);
                     var newFilePath = fullFilePath.Replace(originalFileName, newName);
+                    //security: check for path traversal exploit
+                    string absoluteFilePath = Path.GetFullPath(newFilePath);
+                    string dataPath = Path.Combine(_webEnv.ContentRootPath, "data");
+                    if (!absoluteFilePath.StartsWith(_webEnv.WebRootPath) && !absoluteFilePath.StartsWith(dataPath))
+                    {
+                        return false;
+                    }
                     File.Move(fullFilePath, newFilePath);
                     return true;
                 }
// Source: https://github.com/hargata/lubelog/commit/c8d5888ebc69e6a163e33f36200233ec845e5c57

Detection Methods for CVE-2026-62279

Indicators of Compromise

• HTTP POST requests to the DuplicateRecordsToOtherVehicles endpoint containing recordIds that do not belong to any vehicle owned by the authenticated user.
• Unexpected appearance of service, fuel, tax, or inspection records in a vehicle that were not created by its owner.
• Application logs showing record read operations by a user ID that does not match the VehicleId owner of the fetched records.

Detection Strategies

• Review LubeLogger web server access logs for high-volume or sequential recordId values submitted to the duplication endpoint.
• Correlate database audit trails between existingRecord.VehicleId ownership and the calling user identity for all duplication calls.
• Add an application-layer rule that flags any request where the source and destination vehicles belong to different owning users.

Monitoring Recommendations

• Enable verbose request logging for all endpoints in VehicleController.cs, retaining request bodies for at least 90 days.
• Alert on any duplication request that references more than a small number of recordIds in a single call.
• Monitor for new record creation clustered in a single destination vehicle within a short time window, which may indicate bulk cross-tenant copying.

How to Mitigate CVE-2026-62279

Immediate Actions Required

• Upgrade all LubeLogger instances to version 1.6.8 or later without delay.
• Audit existing vehicles and records for entries that do not match expected user ownership and remove attacker-created copies.
• Rotate or invalidate any attachment file paths that may have been disclosed via copied records.
• Review authentication logs and revoke suspicious low-privilege accounts on multi-user deployments.

Patch Information

The fix is delivered in LubeLogger 1.6.8. Refer to the GitHub Security Advisory GHSA-3r34-mx83-q67r, the GitHub Pull Request #1395, the GitHub Commit Details, and the GitHub Release v1.6.8 for full remediation details. Related discussion is available in GitHub Issue #1398.

Workarounds

• Restrict LubeLogger to single-user deployments until the upgrade to 1.6.8 is completed.
• Place the LubeLogger web interface behind a reverse proxy that denies requests to the DuplicateRecordsToOtherVehicles path for non-administrative users.
• Temporarily disable account self-registration to prevent untrusted users from obtaining the low-privilege access required for exploitation.

# Example nginx rule to block the vulnerable endpoint until patching
location ~* /Vehicle/DuplicateRecordsToOtherVehicles {
    deny all;
    return 403;
}