CVE-2026-52851: Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Permission(LinkedHashMap<String, Long>) in src/main/java/org/traccar/model/Permission.java validates only the first two keys, but DatabaseStorage.removePermission() in src/main/java/org/traccar/storage/DatabaseStorage.java concatenates every map key into the SQL WHERE clause as a column identifier. The extra key therefore becomes attacker-controlled SQL and provides a blind boolean or error oracle that can extract arbitrary database values, including administrator email, password hashes, and salts, or conditionally delete permission rows. Unauthenticated requests are rejected. This issue is fixed in 6.14.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Traccarto a version that resolves this vulnerability.Fixed in 6.14.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a non-readonly Traccar user and have access to an object that can be used in a permission pair. Unauthenticated requests are rejected.
What can an attacker do through the injection?
The attacker can use blind boolean or error-based behavior to extract arbitrary database values, including administrator email addresses, password hashes, and salts. They may also conditionally delete permission rows.
Which versions are affected and how is it remediated?
Traccar versions prior to 6.14.0 are affected. Upgrade to version 6.14.0, which includes the fix.