lubelog vulnerabilities

2 known vulnerabilities in lubelog from Hargata. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  lubelog: Authorization Bypass Through User-Controlled Key

  CVE-2026-62279Sep 18, 2026Hargata

  LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user could submit caller-controlled recordIds to the DuplicateRecordsToOtherVehicles endpoint while naming destination vehicleIds

• 8.1 High severity

  lubelog: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-62278Sep 18, 2026Hargata

  LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs t