CVE-2026-52851
HighCVSS 7.1Summary
In Traccar prior to 6.14.0, an authenticated non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Validation checks only the first two keys, but removePermission() concatenates every map key into the SQL WHERE clause as column identifiers, enabling SQL injection and extraction of arbitrary database values, including administrator email, password hashes, and salts. The issue is fixed in 6.14.0.
Risk Assessment
An attacker with logged-in user privileges can exploit blind SQL injection to extract sensitive data, including administrator credentials, or conditionally delete permission rows. This can lead to privilege escalation and full system compromise.
Recommendation
Update Traccar to version 6.14.0 or later. Until patched, restrict the privileges of users who can invoke DELETE /api/permissions.
Other vulnerabilities in Traccar
See all- CVE-2026-52852Medium
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. GroupResource permits the parent cycle, while AttributeUtil.lookup follows group parents without cycle detection, a visited set, or a depth limit, causing the lookup to never terminate, pinning a Jetty worker at high CPU and potentially exhausting the web/API worker pool when requests are repeated.
- CVE-2026-44314Medium
Traccar before 6.13.0 has a vulnerability in DeviceResource.uploadImage that authorizes the device only via Condition.Permission, but does not check readonly/deviceReadonly for non-admins. An unauthorized user can replace a device's image in the server media directory.
Original NVD description (English source)
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Permission(LinkedHashMap<String, Long>) in src/main/java/org/traccar/model/Permission.java validates only the first two keys, but DatabaseStorage.removePermission() in src/main/java/org/traccar/storage/DatabaseStorage.java concatenates every map key into the SQL WHERE clause as a column identifier. The extra key therefore becomes attacker-controlled SQL and provides a blind boolean or error oracle that can extract arbitrary database values, including administrator email, password hashes, and salts, or conditionally delete permission rows. Unauthenticated requests are rejected. This issue is fixed in 6.14.0.