CVE-2026-52851 Details
Description
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Permission(LinkedHashMap<String, Long>) in src/main/java/org/traccar/model/Permission.java validates only the first two keys, but DatabaseStorage.removePermission() in src/main/java/org/traccar/storage/DatabaseStorage.java concatenates every map key into the SQL WHERE clause as a column identifier. The extra key therefore becomes attacker-controlled SQL and provides a blind boolean or error oracle that can extract arbitrary database values, including administrator email, password hashes, and salts, or conditionally delete permission rows. Unauthenticated requests are rejected. This issue is fixed in 6.14.0.
A blind SQL injection vulnerability has been identified in Traccar, an open-source GPS tracking system, in versions prior to 6.14.0. The issue arises in the DELETE /api/permissions endpoint, where an authenticated, non-readonly user can exploit the permission handling to inject SQL through an extra JSON key. The vulnerability allows extraction of arbitrary database values, such as administrator email, password hashes, and salts, or conditional deletion of permission rows. The root cause lies in insufficient validation of JSON keys in the Permission constructor, which allows additional keys to be treated as SQL identifiers and manipulated for unauthorized data access or modification.
Users are advised to update to Traccar version 6.14.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/traccar/traccar/security/advisories/GHSA-jx5h-fxhc-cc9w | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/traccar/traccar/commit/cd0dbaf5df806139f508cbafaba20b34e62b499e | [email protected] | Source CodeVendor |
| https://github.com/traccar/traccar/releases/tag/v6.14.0 | [email protected] | Release NotesVendor |
| https://github.com/traccar/traccar/security/advisories/GHSA-jx5h-fxhc-cc9w | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Traccar | <= 6.13.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |