# CVE-2026-52851: Traccar permission SQL injection via extra JSON keys

Source: https://junglewise.ai/threats/cve-2026-52851-traccar-permission-sql-injection-via-extra-json-keys  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-52851 · Severity: high · CVSS 7.1 · Published 2026-09-17

Traccar is an open-source GPS tracking system that manages location data and user permissions. An authenticated non-readonly user can inject SQL code through the permission API by submitting extra JSON keys, allowing an attacker to extract sensitive database information (admin credentials, password hashes) or delete permission records. This requires valid user account access but does not require administrator privileges.

Technologies: [Traccar](https://junglewise.ai/threats/technologies/traccar). Vendors: [Traccar](https://junglewise.ai/threats/vendors/traccar).

## Quick answers

**Is CVE-2026-52851 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52851 being exploited in the wild.

**How severe is CVE-2026-52851?** High severity, with a CVSS score of 7.1, published 17 September 2026.

**Which products and versions are affected?** Traccar prior to 6.14.0.

**Is there a fix for CVE-2026-52851?** A patch was published on 2026-05-30: Fix released in version 6.14.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52851 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-52851?** Check whether you run Traccar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a SQL injection vulnerability in the permission management API. The Permission model validates only the first two JSON keys in a DELETE /api/permissions request, but DatabaseStorage.removePermission() concatenates all map keys directly into the SQL WHERE clause without proper parameterization. An authenticated, non-readonly user can submit an extra attacker-controlled JSON key that becomes unvalidated SQL, creating a blind boolean or error-based oracle for data extraction. The vulnerability affects versions prior to 6.14.0; the fix validates permission keys before processing. Unauthenticated requests are rejected, limiting the attack surface to existing users.

## Affected products

- Traccar Traccar prior to 6.14.0

## Timeline

- 2026-09-17: disclosed
- 2026-05-30: patched: Fix released in version 6.14.0

## References

- [https://github.com/traccar/traccar/commit/cd0dbaf5df806139f508cbafaba20b34e62b499e](https://github.com/traccar/traccar/commit/cd0dbaf5df806139f508cbafaba20b34e62b499e)
- [https://github.com/traccar/traccar/releases/tag/v6.14.0](https://github.com/traccar/traccar/releases/tag/v6.14.0)

## Related threats

- [Traccar authentication bypass in LDAP empty password handling](https://junglewise.ai/threats/cve-2026-126777-traccar-3-15-before-6-17-0-contains-an-authentication-bypass)
- [Traccar path parameter bypass in media endpoint](https://junglewise.ai/threats/cve-2026-104203-traccar-is-an-open-source-gps-tracking-system-from-5-1-until-6)
- [Traccar CSRF vulnerability in OpenID Connect authentication](https://junglewise.ai/threats/cve-2026-108738-traccar-5-7-through-6-16-0-contains-a-cross-site-request-forgery)
- [Traccar password recovery token misuse vulnerability](https://junglewise.ai/threats/cve-2026-108737-traccar-through-6-16-0-contains-a-weak-password-recovery)
- [Traccar group hierarchy cycle denial of service](https://junglewise.ai/threats/cve-2026-52852-traccar-group-hierarchy-cycle-denial-of-service)