Is CVE-2026-62277 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62277 being exploited in the wild.

How severe is CVE-2026-62277?

Medium severity, with a CVSS score of 6.5, published 30 October 2026.

Which products and versions are affected?

Hargata LubeLogger prior to 1.6.8.

Is there a fix for CVE-2026-62277?

Yes: fixed in 1.6.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62277 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-62277?

Check whether you run Hargata LubeLogger at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62277: LubeLogger insecure direct object reference in PrintRecordStickers

CVE-2026-62277 · Severity: medium · CVSS 6.5 · Published 2026-10-30

LubeLogger is an open-source web application that tracks vehicle maintenance and fuel consumption. An authenticated user can exploit an authorization bypass to view other users' maintenance records by submitting a request with an authorized vehicle ID but record IDs from other vehicles. An attacker can enumerate and retrieve detailed information about maintenance history, costs, and file metadata across all users on the system.

Technologies: Hargata LubeLogger. Vendors: Hargata.

Quick answers

Is CVE-2026-62277 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62277 being exploited in the wild.
How severe is CVE-2026-62277?: Medium severity, with a CVSS score of 6.5, published 30 October 2026.
Which products and versions are affected?: Hargata LubeLogger prior to 1.6.8.
Is there a fix for CVE-2026-62277?: Yes: fixed in 1.6.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62277 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-62277?: Check whether you run Hargata LubeLogger at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.6.8

Technical details

The PrintRecordStickers endpoint in VehicleController.cs validates that the caller can view the specified vehicleId but fails to validate that each supplied recordId belongs to that authorized vehicle. An authenticated attacker can submit POST requests to /Vehicle/PrintRecordStickers with caller-supplied recordIds enumerated from other users, retrieving records across multiple data stores (gas, service, repair, upgrade, tax, supply, note, odometer, reminder, plan, inspection, equipment) without access control checks.

Affected products

hargata LubeLogger prior to 1.6.8

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.