CVE-2026-104203

The open source GPS tracking system Traccar (versions 5.1 until 6.15.0) contains a vulnerability where an unauthenticated attacker can bypass session and device authorization checks. The root cause is a discrepancy in routing meanings for path parameters at /api/media/* between WebModule.java's M...

PT-2026-137127

Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/. An unauthenticated attacker who knows or guesses a device unique ID and...