CVE-2026-52852
MediumCVSS 6.5Summary
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. GroupResource permits the parent cycle, while AttributeUtil.lookup follows group parents without cycle detection, a visited set, or a depth limit, causing the lookup to never terminate, pinning a Jetty worker at high CPU and potentially exhausting the web/API worker pool when requests are repeated.
Risk Assessment
This can lead to server resource exhaustion and denial of service (DoS) for the Traccar application.
Recommendation
Update Traccar to version 6.14.0, which contains the fix for this issue.
Other vulnerabilities in Traccar
See all- CVE-2026-52851High
In Traccar prior to 6.14.0, an authenticated non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Validation checks only the first two keys, but removePermission() concatenates every map key into the SQL WHERE clause as column identifiers, enabling SQL injection and extraction of arbitrary database values, including administrator email, password hashes, and salts. The issue is fixed in 6.14.0.
- CVE-2026-44314Medium
Traccar before 6.13.0 has a vulnerability in DeviceResource.uploadImage that authorizes the device only via Condition.Permission, but does not check readonly/deviceReadonly for non-admins. An unauthorized user can replace a device's image in the server media directory.
Original NVD description (English source)
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. org.traccar.api.resource.GroupResource permits the parent cycle, while org.traccar.helper.model.AttributeUtil.lookup follows group parents without cycle detection, a visited set, or a depth limit. The storage-backed lookup reached through TripsConfig. and ReportUtils.slowTripsAndStops never terminates, pins a Jetty worker at high CPU after the client disconnects, and can exhaust the web/API worker pool when requests are repeated. The position-ingestion cache-backed path is not part of the confirmed affected scope. This issue is fixed in 6.14.0.