Quick answers
- Is CVE-2026-52851 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-52851 being exploited in the wild.
- How severe is CVE-2026-52851?
- High severity, with a CVSS score of 7.1, published 17 September 2026.
- Which products and versions are affected?
- Traccar prior to 6.14.0.
- Is there a fix for CVE-2026-52851?
- A patch was published on 2026-05-30: Fix released in version 6.14.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-52851 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-52851?
- Check whether you run Traccar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a SQL injection vulnerability in the permission management API. The Permission model validates only the first two JSON keys in a DELETE /api/permissions request, but DatabaseStorage.removePermission() concatenates all map keys directly into the SQL WHERE clause without proper parameterization. An authenticated, non-readonly user can submit an extra attacker-controlled JSON key that becomes unvalidated SQL, creating a blind boolean or error-based oracle for data extraction. The vulnerability affects versions prior to 6.14.0; the fix validates permission keys before processing. Unauthenticated requests are rejected, limiting the attack surface to existing users.
Affected products
- Traccar Traccar prior to 6.14.0
Timeline
- 2026-09-17: disclosed
- 2026-05-30: patched: Fix released in version 6.14.0