What is the CVSS score of CVE-2026-48745?

CVE-2026-48745 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Traccar Client are affected by CVE-2026-48745?

Traccar Client GPS tracking application (versions 9.7.19 and below) contains a critical vulnerability that allows attackers to silently redirect all location telemetry to attacker-controlled servers…

How to fix or mitigate CVE-2026-48745?

Within 24 hours: Inventory all Traccar Client instances running version 9.7.19 or below; restrict outbound connectivity to known legitimate Traccar servers where operationally feasible. Within 7 days: Upgrade all affected installations to Traccar Client version 9.7.20 or later and verify active configurations match expected settings. Within 30 days: Review tracking logs for evidence of server redirection and audit all device configurations for unauthorized modifications since initial deployment.

Traccar Client CVE-2026-48745

CRITICAL

Improper Verification of Source of a Communication Channel (CWE-940)

2026-06-16 GitHub_M

Information Disclosure Traccar Traccar Client

9.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

9.3 CRITICAL

Deep link is network-deliverable with low complexity and no privileges, but requires a single user tap (UI:R); telemetry redirection to a third-party server justifies S:C with high C and I impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 00:08 vuln.today

Analysis Generated

Jun 17, 2026 - 00:08 vuln.today

DescriptionCVE.org

Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry to an attacker-controlled server. The app registers a custom org.traccar.client://config deep-link scheme that silently writes attacker-supplied parameters (server URL, device ID, accuracy, distance, and interval) into the app's persistent configuration with no confirmation, notification, or visual indication. A single crafted link delivered via SMS, email, a webpage, or any installed app can therefore reconfigure the app the moment the victim taps it, with no special permissions required. As a result, an attacker can covertly redirect all of the victim's GPS telemetry to their own server at maximum precision and frequency, and the change persists across restarts. This gives the attacker continuous, real-time tracking of the victim's location. This issue has been fixed in version 9.7.20.

AnalysisAI

Silent configuration hijack in Traccar Client GPS tracking app (versions 9.7.19 and below) allows remote attackers to redirect victim telemetry to attacker-controlled servers via a single crafted org.traccar.client://config deep link. The app accepts deep-link parameters (server URL, device ID, accuracy, distance, interval) and writes them to persistent configuration with no user confirmation, enabling continuous covert location tracking. No public exploit identified at time of analysis, but the upstream commit confirms a confirmation dialog was added in 9.7.20 as the fix.

Technical ContextAI

Traccar Client is a Flutter/Dart mobile application (per the commit diff touching lib/main.dart) that registers a custom URI scheme org.traccar.client://config to allow programmatic configuration via deep links. The underlying flaw is CWE-940 (Improper Verification of Source of a Communication Channel): the app's app_links handler invoked ConfigurationService.applyUri(uri) directly on any inbound URI without authenticating the link source or prompting the user, so any local app, browser navigation, SMS, or email link could rewrite the tracking server URL, device ID, and reporting cadence into persistent storage. The affected CPE is cpe:2.3:a:traccar:traccar-client:*, and the commit 23558b0a shows the fix inserts an AlertDialog (configurationMessage 'Apply new configuration?') gating applyUri behind explicit user consent.

RemediationAI

Vendor-released patch: upgrade to Traccar Client 9.7.20, which introduces an explicit 'Apply new configuration?' confirmation dialog before any deep-link-supplied parameters are written to persistent configuration (see commit 23558b0a and advisory GHSA-vm6j-6g39-gj97). Until users can update, fleet administrators should instruct users not to tap unsolicited org.traccar.client:// links from SMS, email, chat, or web pages, and on managed devices consider using MDM to restrict the app or block the custom URI scheme - note this will also disable any legitimate provisioning workflows that rely on deep-link configuration. After updating, audit the configured server URL, device ID, and reporting interval in the app settings to detect any prior tampering, since a hijacked configuration persists across restarts.