What is CVE-2026-44314?

CVE-2026-44314 is a medium-severity vulnerability in Traccar, classified under Incorrect Authorization. CVSS score: 4.3/10. Published 2026-05-26.

How severe is CVE-2026-44314?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Traccar

CVE-2026-44314

Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.Permission(User.class, getUserId(), Device.class) and then immediately streams the uploaded body…

Vulnerability class: Broken Access Control

EPSS: 0.000 (8.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Affected products

Traccar — versions < 6.13.0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

security-advisories@github.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-44314?: CVE-2026-44314 is a medium-severity vulnerability in Traccar, classified under Incorrect Authorization. CVSS score: 4.3/10. Published 2026-05-26.
How severe is CVE-2026-44314?: Medium severity. CVSS v3 base score is 4.3 out of 10.