CVE-2026-52851

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Permission(LinkedHashMap<String, Long>) in src/main/java/org/traccar/model/Permission.java validates only the first two keys, but DatabaseStorage.removePermission() in src/main/java/org/traccar/storage/DatabaseStorage.java concatenates every map key into the SQL WHERE clause as a column identifier. The extra key therefore becomes attacker-controlled SQL and provides a blind boolean or error oracle that can extract arbitrary database values, including administrator email, password hashes, and salts, or conditionally delete permission rows. Unauthenticated requests are rejected. This issue is fixed in 6.14.0.

• CWE-89

• https://github.com/traccar/traccar/commit/cd0dbaf5df806139f508cbafaba20b34e62b499e
• https://github.com/traccar/traccar/releases/tag/v6.14.0
• https://github.com/traccar/traccar/security/advisories/GHSA-jx5h-fxhc-cc9w
• https://github.com/traccar/traccar/security/advisories/GHSA-jx5h-fxhc-cc9w

Published

Sep 17, 2026

Last Modified

Sep 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52843Lightpanda is a headless browser designed for AI and automat…9.3
• CVE-2026-52844Caddy is an extensible server platform that uses TLS by defa…7.5
• CVE-2026-52845Caddy is an extensible server platform that uses TLS by defa…8.1
• CVE-2026-52846Caddy is an extensible server platform that uses TLS by defa…4.2
• CVE-2026-5285Use after free in WebGL in Google Chrome prior to 146.0.7680…8.8
• CVE-2026-52850Docmost is open-source collaborative wiki and documentation …4.3
• CVE-2026-52852Traccar is an open source GPS tracking system. Prior to 6.14…6.5
• CVE-2026-52853Docmost is open-source collaborative wiki and documentation …5.2
• CVE-2026-52854Maps is a MediaWiki extension that enables visualization of …8.6
• CVE-2026-52855Wings is the server control plane for Pterodactyl, a free, o…9.9
• CVE-2026-52856Wings is the server control plane for Pterodactyl, a free, o…7.5
• CVE-2026-52857Wings is the server control plane for Pterodactyl, a free, o…5.5