Executive brief
Traccar is an open-source GPS tracking system that manages location data and user permissions. An authenticated non-readonly user can inject SQL code through the permission API by submitting extra JSON keys, allowing an attacker to extract sensitive database information (admin credentials, password hashes) or delete permission records. This requires valid user account access but does not require administrator privileges.
Technical details
This is a SQL injection vulnerability in the permission management API. The Permission model validates only the first two JSON keys in a DELETE /api/permissions request, but DatabaseStorage.removePermission() concatenates all map keys directly into the SQL WHERE clause without proper parameterization. An authenticated, non-readonly user can submit an extra attacker-controlled JSON key that becomes unvalidated SQL, creating a blind boolean or error-based oracle for data extraction. The vulnerability affects versions prior to 6.14.0; the fix validates permission keys before processing. Unauthenticated requests are rejected, limiting the attack surface to existing users.
Affected products
- Traccar Traccar prior to 6.14.0
Timeline
- 2026-09-17: disclosed
- 2026-05-30: patched: Fix released in version 6.14.0