sourcentis mercator up to 2025.05.18 /admin/queries/execute QueryController::execute hidden private personal information

Summaryinfo

A vulnerability was found in sourcentis mercator up to 2025.05.18. It has been declared as problematic. This affects the function QueryController::execute of the file /admin/queries/execute. Executing a manipulation of the argument hidden can lead to private personal information. This vulnerability is registered as CVE-2026-49344. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in sourcentis mercator up to 2025.05.18. It has been declared as problematic. This vulnerability affects the function QueryController::execute of the file /admin/queries/execute. The manipulation of the argument hidden with an unknown input leads to a private personal information vulnerability. The CWE definition for the vulnerability is CWE-359. The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected. As an impact it is known to affect confidentiality. CVE summarizes:

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine (`/admin/queries/execute`) accepts a JSON DSL (`from` / `select` / `filters` / `traverse` / `output`), translates it into an Eloquent query, and returns results as JSON. The controller method `QueryController::execute()` does not enforce an authorization gate, unlike `store()` and `massDestroy()` in the same controller which are correctly protected. As a result, any authenticated account — including the read-only Auditor role — can query models beyond its intended scope, including the `User` model. Additionally, the `password` column, although declared `$hidden`, is not excluded from filter predicates, which allows it to be used in `LIKE` conditions. The `schema()` and `schemaModel()` endpoints of the same controller are similarly unguarded. The Query Engine is read-only; integrity and availability are not affected. Version 2025.05.19 patches the issue.

The advisory is available at github.com. This vulnerability was named CVE-2026-49344 since 05/29/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1589 by the MITRE ATT&CK project.

Upgrading to version 2025.05.19 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-38071). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• sourcentis

Name

• mercator

Version

• 2025.05.0
• 2025.05.1
• 2025.05.2
• 2025.05.3
• 2025.05.4
• 2025.05.5
• 2025.05.6
• 2025.05.7
• 2025.05.8
• 2025.05.9
• 2025.05.10
• 2025.05.11
• 2025.05.12
• 2025.05.13
• 2025.05.14
• 2025.05.15
• 2025.05.16
• 2025.05.17
• 2025.05.18

Website

• Product: https://github.com/sourcentis/mercator/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion