CVE-2026-48745
CWE-940Published: June 17, 2026· Updated: Jun 17, 2026
Official Description
Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry to an attacker-controlled server. The app registers a custom org.traccar.client://config deep-link scheme that silently writes attacker-supplied parameters (server URL, device ID, accuracy, distance, and interval) into the app's persistent configuration with no confirmation, notification, or visual indication. A single crafted link delivered via SMS, email, a webpage, or any installed app can therefore reconfigure the app the moment the victim taps it, with no special permissions required. As a result, an attacker can covertly redirect all of the victim's GPS telemetry to their own server at maximum precision and frequency, and the change persists across restarts. This gives the attacker continuous, real-time tracking of the victim's location. This issue has been fixed in version 9.7.20.
Risk Analysis
This critical vulnerability in Traccar Client versions 9.7.19 and below allows a single crafted deep link to silently hijack all GPS tracking parameters. With a CVSS score of 9.3, it poses a severe risk, as an attacker can covertly redirect telemetry to their own server, compromising user privacy and location data. The lack of an EPSS score means the exploitation likelihood is currently unknown, but the high CVSS score indicates urgency.
No public exploit is currently known for this vulnerability. Its remote exploitability (AV:N) and low attack complexity (AC:L) mean it could be exploited by an unauthenticated attacker via user interaction (UI:R) with a malicious link.
To mitigate this vulnerability, users should update Traccar Client to a version beyond 9.7.19. Users should also exercise caution when clicking on unfamiliar links received via SMS, email, or other channels.
Technical Analysis
CVE-2026-48745 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.3.
The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (3)
Quick Facts
Related CVEs (CWE-940)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-48745 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts