Mercator EUVD-2026-38071

Requires (1) a valid authenticated session on the target Mercator instance - any role suffices, including the read-only Auditor role, because the QueryController::execute() method has no role/permission gate; (2) network reachability to the /admin/queries/execute endpoint (and /admin/queries/schema, /admin/queries/schemaModel for enumeration); (3) Mercator version prior to 2025.05.19. Limiting factors: the attacker must already hold credentials (PR:L per CVSS 4.0), the engine is read-only so no data modification is possible, and extraction of the $hidden password column requires blind inference via LIKE filter predicates rather than direct disclosure, slowing automated mass-extraction.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) of 7.1 accurately reflects a network-reachable, low-complexity confidentiality-only flaw requiring low privileges - any authenticated account, including the explicitly read-only Auditor role, is sufficient. There is no EPSS score, KEV listing, or public POC referenced, so the signal set points to a known but not yet weaponized issue; given Mercator's niche deployment (internal IS-mapping tool typically behind SSO/VPN), real-world exposure is likely limited to insider-threat and post-foothold scenarios rather than mass scanning. The integrity/availability impact is correctly zero (the engine is read-only), but the ability to extract password hashes via LIKE predicates is a meaningful escalation path that raises practical impact above what a pure information-disclosure label suggests. Priority should be high for any organization where low-privilege Mercator accounts (auditors, contractors) are provisioned more loosely than admin accounts.

An attacker with any valid Mercator login (e.g. a compromised Auditor contractor account) sends a POST to /admin/queries/execute with a JSON DSL targeting from: User, then uses filters with LIKE patterns against the password column to extract the bcrypt hash one character at a time through blind oracle responses. Once the admin's password hash is recovered, the attacker cracks it offline and pivots to full administrative control of the asset/process inventory. No public exploit identified at time of analysis, but the technique is straightforward given the documented DSL.