CVE-2026-104203

The open source GPS tracking system Traccar (versions 5.1 until 6.15.0) contains a vulnerability where an unauthenticated attacker can bypass session and device authorization checks. The root cause is a discrepancy in routing meanings for path parameters at /api/media/* between WebModule.java's M...