Traccar EUVD-2026-82388

Requires an authenticated Traccar account that is NOT read-only and that holds access to at least one object usable in a permission pair (e.g. a device/group/user link), per the description. Exploitation is performed by submitting DELETE /api/permissions with an extra, attacker-chosen JSON key beyond the two validated keys; that key name is concatenated into the SQL WHERE clause. Limiting factors: unauthenticated requests are explicitly rejected, the account must have write (non-readonly) permissions, and only affects Traccar versions prior to 6.14.0 - patched instances validate that the permission map contains exactly two keys.

This is a genuine, well-substantiated SQL injection (CWE-89) confirmed by vendor advisory GHSA-jx5h-fxhc-cc9w and a specific fix commit, with the root cause visible in the diff (DatabaseStorage.removePermission concatenated every JSON map key as a SQL column identifier while Permission.java validated only two). The vendor CVSS of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) is well-calibrated: network-reachable and low-complexity, but gated by PR:L - the attacker must already be an authenticated, non-readonly user holding a usable permission-pair object, so this is not an unauthenticated pre-auth breach. Impact is real: a blind boolean/error oracle enables extraction of arbitrary DB values including administrator email, password hashes and salts (justifying C:H), plus conditional permission-row deletion (I:L). No EPSS score, no CISA KEV listing, and no public POC were provided, so this is 'no public exploit identified at time of analysis' - a patch-and-prioritize item rather than an actively-exploited emergency. The main risk amplifier is that credential-hash exfiltration can escalate a low-privilege account toward full admin compromise, which elevates practical severity above the raw score for internet-exposed Traccar instances.

An authenticated non-readonly Traccar user who has access to any object usable in a permission pair sends DELETE /api/permissions with a JSON body containing the two legitimate keys plus a third attacker-controlled key whose name is injected verbatim into the SQL WHERE clause. By crafting boolean or error conditions in that key, the attacker turns the endpoint into a blind oracle and iteratively extracts the administrator's email, password hash and salt. No public POC was provided, but the fix commit and advisory fully disclose the mechanism.