CVE-2026-49344: Mercator Authentication Bypass Vulnerability

CVE-2026-49344 Overview

CVE-2026-49344 is a missing authorization vulnerability in Mercator, an open source web application for mapping information systems. The flaw resides in the Query Engine endpoint /admin/queries/execute, which translates a JSON DSL into Eloquent queries without enforcing an authorization gate. Any authenticated account, including the read-only Auditor role, can query models outside its intended scope. The User model is reachable, and the password column — though declared $hidden — remains usable in LIKE filter predicates. This enables incremental extraction of password hashes. Versions prior to 2025.05.19 are affected [CWE-359].

Critical Impact
Authenticated low-privilege users can extract password hashes and other sensitive fields by abusing unguarded query, schema, and schemaModel endpoints.

Affected Products

Mercator information system mapping application
All versions prior to 2025.05.19
QueryController::execute(), schema(), and schemaModel() endpoints

Discovery Timeline

2026-06-19 - CVE-2026-49344 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49344

Vulnerability Analysis

Mercator's Query Engine exposes a JSON Domain Specific Language (DSL) at /admin/queries/execute. The DSL supports from, select, filters, traverse, and output clauses that map to Eloquent ORM operations and return JSON. The controller method QueryController::execute() omits the authorization gate that protects sibling methods store() and massDestroy() in the same controller. Any authenticated user, regardless of role, can therefore issue queries against arbitrary models. The companion endpoints schema() and schemaModel() are similarly unguarded and reveal model metadata to low-privilege callers.

Root Cause

The root cause is missing authorization enforcement on read-path controller methods, combined with incomplete handling of $hidden model attributes. Laravel's $hidden property suppresses fields in serialized output but does not block them from appearing in query predicates. The password column can be referenced in LIKE filters, allowing character-by-character inference of stored hash values even when the column is never returned in the response body.

Attack Vector

An attacker with any authenticated session — including the read-only Auditor role — submits a crafted JSON DSL payload to /admin/queries/execute. The payload targets the User model with LIKE filter predicates against the password column. By iterating predicates and observing which queries return matching rows, the attacker reconstructs password hashes one character at a time. The schema() and schemaModel() endpoints aid reconnaissance by enumerating queryable models and their columns. The Query Engine is read-only, so integrity and availability are not affected; confidentiality is the sole impact.

No verified exploitation code is published. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-49344

Indicators of Compromise

POST requests to /admin/queries/execute originating from Auditor or other low-privilege accounts.
DSL payloads referencing from: User or filter predicates targeting the password column.
Repeated requests with incrementally changing LIKE patterns indicating hash inference.
Access to /admin/queries/schema or /admin/queries/schemaModel from non-administrator sessions.

Detection Strategies

Parse application access logs for the three endpoints and correlate requester role against the queried model.
Alert on any DSL payload that includes the string password in a filter clause.
Baseline normal Query Engine usage per role and flag deviations such as high-volume sequential queries.

Monitoring Recommendations

Enable verbose request logging on the Mercator QueryController and forward logs to a centralized SIEM.
Track authentication context alongside DSL payload content for forensic reconstruction.
Monitor outbound data volume from Mercator instances for unexpected spikes tied to low-privilege accounts.

How to Mitigate CVE-2026-49344

Immediate Actions Required

Upgrade Mercator to version 2025.05.19 or later, which patches the missing authorization checks.
Rotate all user passwords and invalidate active sessions if logs show suspicious Query Engine activity.
Audit accounts assigned the Auditor role and review their recent request history.

Patch Information

Version 2025.05.19 adds the authorization gate to QueryController::execute(), schema(), and schemaModel(), aligning them with store() and massDestroy(). The patch also excludes the password column from filter predicates. Patch details are available in the GitHub Security Advisory GHSA-q3r8-3h7c-96w3.

Workarounds

Restrict network access to /admin/queries/* to administrator IP ranges via a reverse proxy until upgrade is possible.
Disable or remove the Auditor role and other low-privilege accounts that do not require Query Engine access.
Apply a web application firewall rule that blocks DSL payloads referencing the password column or the User model.

bash

# Example reverse proxy restriction (nginx)
location /admin/queries/ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://mercator_backend;
}