LubeLogger’s PrintRecordStickers endpoint performs an ownership check for the supplied vehicleId but fails to verify that each recordId actually belongs to that vehicle. An authenticated user can send a POST request with an authorized vehicleId and supply a list of arbitrary record identifiers. By selecting an ImportMode, the request retrieves detailed information from records belonging to other users’ vehicles. Exposed data includes descriptions, costs, notes, mileage, extra fields and file attachment metadata, enabling a full history of other customers’ maintenance activities. The flaw is an Authorization Bypass via User-Controlled Key, identified as CWE‑639.

The vulnerability affects the LubeLogger application released by Hargata. Every version before 1.6.8 of LubeLogger is susceptible; the issue was addressed in release 1.6.8. Users running any older version should consider upgrading to mitigate the risk.

The CVSS score of 6.5 indicates a moderate impact, but the lack of an EPSS score suggests limited exploitation evidence at present. The issue is not listed in CISA’s KEV catalog, implying no known widespread exploitation. The attack vector requires an authenticated session to send a POST to /Vehicle/PrintRecordStickers, so the vulnerability is best characterized as authenticated, server-side data exfiltration through an IDOR flaw.