The vulnerability is an IDOR in the DuplicateRecordsToOtherVehicles endpoint that lets an authenticated user specify arbitrary source record identifiers and copy them into any vehicle they are allowed to edit, while the system incorrectly skips an authorization check on the source vehicle. Because the endpoint copies all categories of records—service, collision, fuel, etc.—an attacker can exfiltrate sensitive maintenance data and persistent copies, including file paths. This can lead to confidentiality breaches and potential future exploitation of trust in the system.

The flaw exists in LubeLogger 1.6.7 and earlier versions of the open‑source, self‑hosted vehicle tracker developed by hargata. Any installation that has not applied the 1.6.8 release, which implements source‑vehicle ownership checks, is affected. All record types stored by the application are vulnerable.

The vulnerability carries a CVSS score of 7.1. The EPSS score is not provided, and the issue is not listed in CISA’s KEV catalog. An attacker needs to be authenticated and have edit access to at least one vehicle; from there, they can craft requests to the DuplicateRecordsToOtherVehicles endpoint, provide any valid record identifiers and target a vehicle they own or can edit. The lack of source‑vehicle authorization enables the copying of arbitrary records, potentially exposing confidential information, but there is no direct code‑execution vector or bypass of server‑side validation of record ownership.