Which versions of Mercator are affected by CVE-2026-49344?

Mercator information system mapping application versions prior to 2025.05.19 contain an authorization bypass vulnerability allowing any authenticated user, including read-only Auditor accounts, to…. A patch is available.

How to fix or mitigate CVE-2026-49344?

Within 24 hours: Review access logs and query audit logs for suspicious activity on the `/admin/queries/execute` endpoint, particularly from Auditor and read-only role accounts querying the User model; preserve logs for forensic analysis. Within 7 days: Upgrade Mercator to version 2025.05.19 or later to apply the vendor-released patch; reset all user passwords if unauthorized access is confirmed. Within 30 days: Audit lower-privilege accounts for signs of exploitation; verify patch deployment across all Mercator instances; implement supplemental access controls restricting the `/admin/queries/execute` endpoint to administrative roles only.

Mercator CVE-2026-49344

Q: What is the CVSS score of CVE-2026-49344?

CVE-2026-49344 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38071 HIGH

Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)

2026-06-19 GitHub_M

Information Disclosure Mercator

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable endpoint exploitable by any authenticated user (PR:L) with no user interaction; only confidentiality is impacted (read-only Query Engine exposing User data and password hashes).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 19, 2026 - 21:02 EUVD

Analysis Generated

Jun 19, 2026 - 20:15 vuln.today

DescriptionCVE.org

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine (/admin/queries/execute) accepts a JSON DSL (from / select / filters / traverse / output), translates it into an Eloquent query, and returns results as JSON. The controller method QueryController::execute() does not enforce an authorization gate, unlike store() and massDestroy() in the same controller which are correctly protected. As a result, any authenticated account - including the read-only Auditor role - can query models beyond its intended scope, including the User model. Additionally, the password column, although declared $hidden, is not excluded from filter predicates, which allows it to be used in LIKE conditions. The schema() and schemaModel() endpoints of the same controller are similarly unguarded. The Query Engine is read-only; integrity and availability are not affected. Version 2025.05.19 patches the issue.

AnalysisAI

Authorization bypass in Mercator information system mapping application prior to version 2025.05.19 allows any authenticated user - including the read-only Auditor role - to query arbitrary Eloquent models via the unprotected /admin/queries/execute endpoint. The flaw permits enumeration of the User model and even allows the supposedly $hidden password column to be probed via LIKE filter predicates, enabling blind extraction of password hashes. No public exploit identified at time of analysis, but the vendor advisory (GHSA-q3r8-3h7c-96w3) confirms the issue and ships a fix.

Technical ContextAI

Mercator is an open-source PHP/Laravel web application by Sourcentis used for mapping enterprise information systems (assets, applications, processes). Its Query Engine exposes a JSON DSL (from/select/filters/traverse/output) that QueryController::execute() translates into Eloquent ORM queries. The root cause is CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor): peer methods store() and massDestroy() enforce an authorization gate, but execute(), schema(), and schemaModel() were left unguarded, so role-based access controls are bypassed at the controller layer. Compounding this, Laravel's $hidden array only suppresses fields from serialized output - it does not prevent those columns from being referenced in WHERE/LIKE predicates, allowing boolean/inference-based extraction of the password hash column even though it is never returned directly. The affected CPE is cpe:2.3:a:sourcentis:mercator:* for all versions prior to 2025.05.19.

RemediationAI

Vendor-released patch: upgrade Mercator to version 2025.05.19 or later, which adds the missing authorization gate to QueryController::execute(), schema(), and schemaModel() (see https://github.com/sourcentis/mercator/security/advisories/GHSA-q3r8-3h7c-96w3). Where immediate upgrade is not possible, restrict access to /admin/queries/execute, /admin/queries/schema, and /admin/queries/schemaModel at the reverse proxy or web server (e.g. nginx/Apache location blocks limited to admin source IPs), accepting that this disables the Query Engine for Auditor-role users; alternatively, temporarily disable or downgrade the Auditor role and any non-administrative accounts until the patch is applied, with the trade-off of reduced audit functionality. As a precaution, rotate all Mercator user passwords after patching, since password-hash enumeration via LIKE may have occurred undetected.