PT-2026-43299 · Traccar · Traccar

Forimoc + 1 · Published 2026-05-26 · Updated 2026-05-27 · CVE-2026-44314

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Traccar versions prior to 6.13.0

Description An authorization bypass exists in the GPS tracking system where the 'DeviceResource.uploadImage' endpoint fails to invoke the permissionsService.checkEdit() function. While the system uses Condition.Permission(User.class, getUserId(), Device.class) for initial authorization, it skips the guard that enforces readonly and deviceReadonly restrictions for non-admin users. This allows an unauthorized user to replace a device's stored image file within the server media directory, modifying UI-visible media and affecting downstream workflows that rely on the persisted image.

Recommendations Update to version 6.13.0.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-44314

GHSA-33V4-5X2G-7MJM

Affected Products

Traccar

References · 5

• 🔥 https://github.com/traccar/traccar/security/advisories/GHSA-33v4-5x2g-7mjm · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44314.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-44314 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44314 · Security Note
• https://twitter.com/dailycve/status/2059688985861976227 · Twitter Post