CVE-2026-52851: Improper Neutralization of Special Elements used in an SQL Command

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. PermissionLinkedHashMap in...

PT-2026-95061

Name of the Vulnerable Software and Affected Versions Traccar versions prior to 6.14.0 Description An authenticated, non-readonly user can exploit a flaw when submitting requests to the 'DELETE /api/permissions' endpoint. The PermissionLinkedHashMap function in...