Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M

CVE-2026-52851Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions

High 7.1

In plain English

A high-severity SQL injection in traccar from traccar. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 66.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Permission(LinkedHashMap<String, Long>) in src/main/java/org/traccar/model/Permission.java validates only the first two keys, but DatabaseStorage.removePermission() in src/main/java/org/traccar/storage/DatabaseStorage.java concatenates every map key into the SQL WHERE clause as a column identifier. The extra key therefore becomes attacker-controlled SQL and provides a blind boolean or error oracle that can extract arbitrary database values, including administrator email, password hashes, and salts, or conditionally delete permission rows. Unauthenticated requests are rejected. This issue is fixed in 6.14.0.

Affected products (as reported)

Vendor	Product	Versions
traccar	traccar	< 6.14.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/traccar/traccar/security/advisories/GHSA-jx5h-fxhc-cc9w x_refsource_CONFIRM
https://github.com/traccar/traccar/commit/cd0dbaf5df806139f508cbafaba20b34e62b499e x_refsource_MISC
https://github.com/traccar/traccar/releases/tag/v6.14.0 x_refsource_MISC