LubeLogger CVE-2026-62277

Requires a valid authenticated account on a multi-user/multi-tenant LubeLogger instance running a version at or below 1.6.7. The attacker must possess at least one vehicleId they are authorized to view so the CollaboratorFilter check passes; they then supply arbitrary caller-controlled integer recordIds and select any ImportMode (service, gas, repair, upgrade, tax, supply, note, odometer, reminder, plan, inspection, equipment). No user interaction and no non-default configuration are needed. Limiting factors: exploitation is impossible without authentication, and a single-user (single-tenant) self-hosted deployment has no other users' records to disclose, so impact is confined to instances shared among multiple untrusted users.

This is a CWE-639 IDOR (broken object-level authorization) rated CVSS 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network-reachable, low attack complexity, but requiring authentication (PR:L) and yielding confidentiality-only impact (C:H, I:N, A:N). No EPSS score and no CISA KEV status were provided in the input, and the vulnerability is not listed as actively exploited, so the strongest exploitation signal is the vendor/GHSA reproduction steps rather than observed attacks. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-not-urgent issue: the flaw is trivially reproducible once a foothold exists, but it is gated behind having an authenticated account on a multi-user instance, which caps blast radius. Note a signal conflict: the GHSA title says 'Unauthenticated Cross-User... Exfiltration,' yet both the CVSS vector (PR:L) and the description ('an authenticated user can submit...') indicate authentication IS required - treat this as authenticated-user IDOR, not an unauthenticated flaw. Realistically this is a genuine priority for shared/multi-tenant LubeLogger deployments but low risk for single-user self-hosted instances where no other tenants' records exist to steal.

On a multi-user LubeLogger instance (prior to 1.6.8), an authenticated low-privilege user issues POST /Vehicle/PrintRecordStickers using one of their own vehicleIds to satisfy the CollaboratorFilter, then supplies arbitrary low integer recordIds and an ImportMode; the endpoint returns another user's records without checking that each record's VehicleId belongs to the authorized vehicle. A public PoC reference exists in the GHSA advisory as step-by-step reproduction instructions; it is not verified as working exploit code. Given AV:N/AC:L and simple integer-ID enumeration, mass harvesting of other tenants' records is straightforward once authenticated.