SQL Injection in Traccar GPS Tracking System Affects User Permissions

CVE-2026-52851

What is CVE-2026-52851?

The Traccar GPS tracking system is vulnerable to SQL injection due to improper validation of user permissions, allowing authenticated users to exploit the DELETE /api/permissions endpoint. An attacker can introduce a malicious JSON key that alters the SQL conditions, thus gaining unauthorized access to sensitive information such as administrator credentials and enabling potential data manipulation. It is crucial for users to upgrade to version 6.14.0 or later to remediate this issue.

References