Unauthenticated Query Execution in Mercator

Executive Summary

CVE-2026-49344 is a vulnerability in the Mercator software versions before 2026.05.09 that arises from improper authorization checks in the QueryController::execute() method. Unlike other methods in the same controller, this method does not enforce access controls, allowing any authenticated user, including those with read-only roles like Auditor, to query data models beyond their intended permissions, including sensitive models like the User model.

Additionally, the password field, although marked as hidden in the application, can still be used as a filter predicate in queries. Attackers can exploit this by using LIKE conditions on the password field and analyzing metadata to progressively reconstruct bcrypt password hashes, leading to credential information disclosure.

The vulnerability requires a valid Mercator account with at least Configure permission and direct network access to the application. The Query Engine is read-only, so system integrity and availability are not affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized access to personally identifiable information (PII) through improper authorization checks in the Mercator Query Executor. Since any authenticated user, including those with limited roles, can query sensitive user data such as password hashes, this poses a risk to confidentiality.

Exposure of PII and credential information can lead to non-compliance with data protection regulations such as GDPR and HIPAA, which mandate strict controls over access to sensitive personal data and require organizations to protect such data from unauthorized disclosure.

Therefore, this vulnerability undermines compliance with these standards by enabling unauthorized data disclosure, potentially resulting in regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability primarily impacts the confidentiality of your data. An attacker with a valid Mercator account can access sensitive information beyond their authorized scope, including personally identifiable information (PII) stored in the User model.

Specifically, attackers can exploit the ability to filter on the password field to reconstruct bcrypt password hashes, potentially compromising user credentials.

However, the vulnerability does not affect the integrity or availability of the system since the Query Engine is read-only.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the `/admin/queries/execute` endpoint of the Mercator application with an authenticated account, including those with read-only roles such as Auditor.

A practical detection method is to send authorized JSON DSL queries that include filters on sensitive fields like the `password` column and observe if the system returns data beyond the intended scope.

For example, you can use curl commands to test the endpoint:

• curl -X POST -H "Content-Type: application/json" -H "Authorization: Bearer <token>" -d '{"from":"User","select":["id","password"],"filters":[{"field":"password","operator":"LIKE","value":"%"}]}' https://<mercator-host>/admin/queries/execute

If the query returns user data including password hashes, it indicates the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Mercator to version 2025.05.19 or later, where the issue has been patched by enforcing proper authorization checks on the `QueryController::execute()` method.

Until the upgrade can be applied, restrict access to the `/admin/queries/execute` endpoint to only trusted users with appropriate permissions and consider network-level controls to limit access.

Additionally, review and tighten role permissions to ensure that read-only roles like Auditor cannot perform queries that expose sensitive data.

Useful 0 Not Useful 0