In hargata lubelog versions before 1.6.8, the DuplicateRecordsToOtherVehicles endpoint allows an authenticated user to submit user-controlled recordIds and specify destination vehicleIds. While the endpoint authorizes the destination vehicles, it fails to check user permissions on the source vehicles for each record. This missing authorization check (CWE-639) enables an attacker to copy service, collision, upgrade, fuel, tax, supply, note, odometer, reminder, plan, inspection, and equipment records from vehicles they do not have permission to edit into vehicles they control, exposing sensitive record contents and attachment paths and creating persistent unauthorized copies. The vulnerability has a CVSS 3.1 score of 7.1 (High severity) and was fixed in version 1.6.8.

An authenticated user can access and copy records belonging to other users without proper authorization, exposing sensitive vehicle maintenance and related data. This unauthorized data exposure affects confidentiality (high impact) and results in persistent unauthorized copies of records. Integrity impact is low since the vulnerability primarily allows copying rather than modification of others' records. Availability is not affected.

Upgrade hargata lubelog to version 1.6.8 or later, where the authorization checks on source vehicle records have been properly implemented. No other mitigation is required as the issue is fixed in this official release.