CVE-2026-49344

Name of the Vulnerable Software and Affected Versions Mercator versions prior to 2025.05.19

Description The Query Engine allows authenticated users to execute queries via a JSON DSL (Domain Specific Language), which is a specialized language used to define data queries. The controller method QueryController::execute() lacks an authorization gate, enabling any authenticated account, including those with read-only Auditor roles, to query models outside their intended scope, such as the User model. Furthermore, the password column is not excluded from filter predicates, allowing it to be used in LIKE conditions. The endpoints '/admin/queries/execute', '/schema()', and '/schemaModel()' are affected. This issue is read-only and does not impact data integrity or availability.

Recommendations Update to version 2025.05.19. As a temporary workaround, restrict access to the '/admin/queries/execute', '/schema()', and '/schemaModel()' endpoints.