# CVE-2026-44314: Traccar incorrect authorization in DeviceResource image upload

Source: https://junglewise.ai/threats/cve-2026-44314-traccar-incorrect-authorization-in-deviceresource-image-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-44314 · Severity: info · CVSS 5.3 · Published 2026-05-26

Traccar is an open-source GPS tracking platform used to manage and monitor vehicle or asset locations. A security flaw in the system allows users who should only have "read-only" access to bypass these restrictions and upload or replace device images. This could allow an unauthorized person to change the visual representation of a device in the management interface or interfere with workflows that rely on these images.

Technologies: [Traccar](https://junglewise.ai/threats/technologies/traccar). Vendors: [Traccar](https://junglewise.ai/threats/vendors/traccar).

## Quick answers

**Is CVE-2026-44314 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44314 being exploited in the wild.

**How severe is CVE-2026-44314?** Informational severity, with a CVSS score of 5.3, published 26 May 2026.

**Which products and versions are affected?** Traccar Prior to 6.13.0.

**Is there a fix for CVE-2026-44314?** A patch was published on 2026-05-26: Fix released in version 6.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44314 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-44314?** Check whether you run Traccar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability exists in the `DeviceResource.uploadImage` endpoint of Traccar. The application validates device permissions using `Condition.Permission` but fails to invoke `permissionsService.checkEdit`, which is the standard mechanism for enforcing `readonly` and `deviceReadonly` restrictions. Consequently, an authenticated user—including those using temporary shared-device tokens intended for read-only access—can trigger a file write to the server's media directory via `mediaManager.createFileStream`. This allows unauthorized modification of device-associated image files. The issue is fixed in version 6.13.0 by ensuring the edit permission check is performed before the file stream is created.

## Affected products

- Traccar Traccar Prior to 6.13.0

## Timeline

- 2026-05-05: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE published to NVD
- 2026-05-26: patched: Fix released in version 6.13.0

## References

- [https://github.com/traccar/traccar/security/advisories/GHSA-33v4-5x2g-7mjm](https://github.com/traccar/traccar/security/advisories/GHSA-33v4-5x2g-7mjm)

## Related threats

- [Traccar authentication bypass in LDAP empty password handling](https://junglewise.ai/threats/cve-2026-126777-traccar-3-15-before-6-17-0-contains-an-authentication-bypass)
- [Traccar path parameter bypass in media endpoint](https://junglewise.ai/threats/cve-2026-104203-traccar-is-an-open-source-gps-tracking-system-from-5-1-until-6)
- [Traccar CSRF vulnerability in OpenID Connect authentication](https://junglewise.ai/threats/cve-2026-108738-traccar-5-7-through-6-16-0-contains-a-cross-site-request-forgery)
- [Traccar password recovery token misuse vulnerability](https://junglewise.ai/threats/cve-2026-108737-traccar-through-6-16-0-contains-a-weak-password-recovery)
- [Traccar group hierarchy cycle denial of service](https://junglewise.ai/threats/cve-2026-52852-traccar-group-hierarchy-cycle-denial-of-service)