CVE-2026-49344
Mercator has a Personal Identifiable Information Leak from Query Executor feature
Description
Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine (`/admin/queries/execute`) accepts a JSON DSL (`from` / `select` / `filters` / `traverse` / `output`), translates it into an Eloquent query, and returns results as JSON. The controller method `QueryController::execute()` does not enforce an authorization gate, unlike `store()` and `massDestroy()` in the same controller which are correctly protected. As a result, any authenticated account — including the read-only Auditor role — can query models beyond its intended scope, including the `User` model. Additionally, the `password` column, although declared `$hidden`, is not excluded from filter predicates, which allows it to be used in `LIKE` conditions. The `schema()` and `schemaModel()` endpoints of the same controller are similarly unguarded. The Query Engine is read-only; integrity and availability are not affected. Version 2025.05.19 patches the issue.
INFO
Published Date :
June 19, 2026, 8:16 p.m.
Last Modified :
Oct. 25, 2026, 11:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update Mercator to version 2025.05.19.
- Apply vendor patches promptly.
- Restrict query engine access.
Public PoC/Exploit Available at Github
CVE-2026-49344 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-49344.
| URL | Resource |
|---|---|
| https://github.com/sourcentis/mercator/security/advisories/GHSA-q3r8-3h7c-96w3 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-49344 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-49344
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-49344 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-49344 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 25, 2026
Action Type Old Value New Value Added Translation Title: mercator de sourcentis, Description: Mercator es una aplicación web de código abierto que permite el mapeo del sistema de información. Antes de la versión 2025.05.19, el Motor de Consultas de Mercator (’/admin/queries/execute’) acepta un DSL JSON (’from’ / ’select’ / ’filters’ / ’traverse’ / ’output’), lo traduce a una consulta Eloquent y devuelve los resultados como JSON. El método del controlador “QueryController::execute()” no aplica una puerta de autorización, a diferencia de “store()” y “massDestroy()” en el mismo controlador, que están correctamente protegidos. Como resultado, cualquier cuenta autenticada -incluido el rol de Auditor de solo lectura- puede consultar modelos más allá de su alcance previsto, incluido el modelo “User”. Además, la columna “password”, aunque declarada “$hidden”, no se excluye de los predicados de filtro, lo que permite su uso en condiciones “LIKE”. Los endpoints “schema()” y “schemaModel()” del mismo controlador están igualmente desprotegidos. El Motor de Consultas es de solo lectura; la integridad y la disponibilidad no se ven afectadas. La versión 2025.05.19 corrige el problema. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 22, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-49344', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-22T14:11:00.912509Z'} -
New CVE Received by [email protected]
Jun. 19, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'sourcentis', 'product': 'mercator', 'versions': [{'status': 'affected', 'version': '< 2025.05.19'}]}] Added Description Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine (`/admin/queries/execute`) accepts a JSON DSL (`from` / `select` / `filters` / `traverse` / `output`), translates it into an Eloquent query, and returns results as JSON. The controller method `QueryController::execute()` does not enforce an authorization gate, unlike `store()` and `massDestroy()` in the same controller which are correctly protected. As a result, any authenticated account — including the read-only Auditor role — can query models beyond its intended scope, including the `User` model. Additionally, the `password` column, although declared `$hidden`, is not excluded from filter predicates, which allows it to be used in `LIKE` conditions. The `schema()` and `schemaModel()` endpoints of the same controller are similarly unguarded. The Query Engine is read-only; integrity and availability are not affected. Version 2025.05.19 patches the issue. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-359 Added Reference https://github.com/sourcentis/mercator/security/advisories/GHSA-q3r8-3h7c-96w3