Traccar EUVD-2026-31852

Exploitation requires a valid authenticated Traccar user session (PR:L confirmed by CVSS vector); unauthenticated access is not sufficient. The bypass is specifically meaningful for users whose accounts are subject to readonly or deviceReadonly restrictions - those accounts are the intended target of the skipped checkEdit guard. The attacker must have been granted at least view-level access to the target device (the Condition.Permission ownership check still applies and must pass). No non-default configuration is required; the uploadImage endpoint is a standard part of the Traccar API surface available in all deployments prior to 6.13.0. Exploitation is limited to image file replacement under the server's media directory and does not extend to other device attributes, credentials, or configuration. The attack is non-automatable per SSVC, meaning mass exploitation across many targets without per-target interaction is not straightforward.

The CVSS 4.0 score of 5.3 (Medium) is consistent with the constrained impact: the vector AV:N/AC:L/AT:N/PR:L/UI:N indicates network-accessible, low-complexity exploitation by any authenticated user, with no additional prerequisites and no user interaction required. The scope is limited to integrity of the media file (VI:L) with no confidentiality or availability impact. EPSS at 0.03% (9th percentile) signals very low observed exploitation probability, which is consistent with the requirement for a valid authenticated session and the narrow, non-critical impact (image file replacement). SSVC classifies exploitation as poc-level, the attack as non-automatable, and technical impact as partial - aligning with the CVSS signal. The vulnerability is not listed in CISA KEV. Taken together, this is a real but low-urgency issue: the authorization bypass is a genuine logic flaw, but attackers need an existing account, can only affect image files rather than sensitive configuration or data, and there is no evidence of active exploitation. Organizations with untrusted or multi-tenant user bases should prioritize patching; single-tenant or admin-only deployments face materially lower risk.

An attacker with a valid low-privilege Traccar account - such as a user account explicitly marked readonly or deviceReadonly - crafts a multipart HTTP POST request directly to the DeviceResource.uploadImage endpoint for a device they can observe in the UI. Because the route validates device ownership but skips the checkEdit permission guard, the server accepts the upload and overwrites the target device's stored image file on disk. A proof-of-concept demonstrating this bypass exists per SSVC data.