PT-2026-45077 · Unknown · Traccar-Client

Akokonunes + 1 · CVE-2026-48745 · Published 2026-05-30 · Updated 2026-06-17

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Traccar Client versions prior to 9.7.20

Description The application registers a custom org.traccar.client://config deep-link scheme that allows the silent modification of persistent configuration settings without user confirmation or notification. An attacker can use a crafted link delivered via SMS, email, a webpage, or another app to hijack GPS tracking parameters, including the server URL, device ID, accuracy, distance, and interval. This enables the covert redirection of real-time GPS telemetry to an attacker-controlled server at maximum precision and frequency, with the changes persisting across device restarts.

Recommendations Update to version 9.7.20.

Exploit

Fix

Weakness Enumeration

CWE-940

Related Identifiers

CVE-2026-48745

GHSA-VM6J-6G39-GJ97

Affected Products

Traccar-Client

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48745.json · Exploit
• 🔥 https://github.com/traccar/traccar-client/security/advisories/GHSA-vm6j-6g39-gj97 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-48745 · Security Note
• https://osv.dev/vulnerability/CVE-2026-48745 · Vendor Advisory
• https://github.com/traccar/traccar-client/commit/23558b0ae390f8480b2233da07410b5aeaafba09 · Note
• https://reddit.com/r/CVEWatch/comments/1tsr525/top_10_trending_cves_31052026 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1ttnlqe/top_10_trending_cves_01062026 · Reddit Post
• https://twitter.com/emgeekboy/status/2060525076165124371 · Twitter Post