CVE-2026-52851

Traccar , an open source GPS tracking system, contains an authenticated blind SQL injection in the DELETE /api/permissions endpoint. The root cause lies in DatabaseStorage.removePermission(), which concatenates every key from the Permission map into the SQL WHERE clause as a column identifier, wh...