CVE-2026-52851

Overview

Traccar prior to version 6.14.0 contains an SQL injection vulnerability in the permission management API endpoint. An authenticated user with standard object access can supply crafted JSON keys during a DELETE request to manipulate database queries. This flaw acts as an oracle to extract sensitive database contents or alter permission mappings.

Description

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Permission(LinkedHashMap ) in src/main/java/org/traccar/model/Permission.java validates only the first two keys, but DatabaseStorage.removePermission() in src/main/java/org/traccar/storage/DatabaseStorage.java concatenates every map key into the SQL WHERE clause as a column identifier. The extra key therefore becomes attacker-controlled SQL and provides a blind boolean or error oracle that can extract arbitrary database values, including administrator email, password hashes, and salts, or conditionally delete permission rows. Unauthenticated requests are rejected. This issue is fixed in 6.14.0.

Impact

The vulnerability impacts confidentiality and integrity by allowing authenticated non-readonly users to extract sensitive data, such as administrator email addresses, password hashes, and cryptographic salts, or modify permission records. Confidentiality is compromised via data exfiltration through blind or error-based techniques, while integrity is threatened by unauthorized deletion of permission entries.

Remediation

Upgrade the Traccar deployment to version 6.14.0 or later where input validation for permission parameters and SQL construction has been properly secured. Ensure strict adherence to the principle of least privilege by auditing user roles and restricting standard user access to permission modification endpoints where applicable.

Risk context

The vulnerability carries a CVSS v3 score of 7.1 (High) due to the potential compromise of sensitive internal data and permission controls. However, the current EPSS score of 0.00022 indicates a low active exploitation probability in the wild, and exploitation strictly requires authenticated access.

Affected products

• Traccar < 6.14.0