Mercator’s Query Engine endpoint allows an authenticated user to submit arbitrary JSON DSL queries that are translated into Eloquent queries and returned as JSON. The execute method lacks an authorization gate, permitting any authenticated account—such as read‑only auditors—to query models beyond their intended scope, including the User model. Because the password column is not excluded from filter predicates, it can be referenced in LIKE conditions and returned in responses, exposing protected credentials. The controller methods that expose schema information are similarly unguarded. The Query Engine is read‑only, so integrity and availability are not affected, but the vulnerability enables legitimate users to access sensitive user credentials and other protected data, constituting a significant breach of confidentiality.

The vulnerable application is the open‑source Mercator platform from sourcentis, versions earlier than 2025.05.19. Any authenticated user, even those with read‑only permissions, can exploit the unprotected Query Engine endpoint to enumerate or retrieve data from any model, especially the User model.

The vulnerability carries a CVSS score of 7.1, representing high severity information‑disclosure risk, and its EPSS score is not available. It is not listed in CISA’s KEV catalog. Exploitation requires only authentication; an attacker with valid credentials can invoke the read‑only Query Engine without elevated privileges. While system integrity and availability remain intact, the flaw can expose sensitive credentials and private user information, making it a high‑priority issue for environments managing protected data.