Traccar authentication bypass exposes device media files

A GPS device tracking server lets anyone view device photos and videos without logging in.

Summary

Traccar, an open source GPS tracking system, lets an unauthenticated attacker download protected device media files. Versions from 5.1 until 6.15.0 are affected.

Affected when

Attacker knows or guesses a device unique ID and media filename

What to do

Update to version 6.15.0.

Products and platforms

Windows
macOS
Linux
traccar

CVE IDs

CVE-2026-104203 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 20:47 UTC

First seen 2026-11-09 16:00 UTC