Server-Side Request Forgery in Mercator Web Application
CVE-2026-49345

5.3MEDIUM

Key Information:

Vendor

Sourcentis

Status
Mercator
Vendor
CVE Published:
19 June 2026

What is CVE-2026-49345?

Mercator, an open source web application for mapping information systems, is susceptible to a Server-Side Request Forgery (SSRF) vulnerability in its configuration panel. This flaw allows authenticated users with specific permissions to manipulate network requests issued by the server. Specifically, the testProvider() method in ConfigurationController does not properly validate URLs, enabling attackers to bypass intended security measures and perform arbitrary outbound requests, including potentially harmful interactions with internal services. This could lead to significant security breaches, including unauthorized data access and Remote Code Execution, especially under certain conditions. The issue has been rectified in version 2025.05.19.

Affected Version(s)

mercator < 2025.05.19

References

https://github.com/sourcentis/mercator/security/advisorie...
x_refsource_CONFIRM

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.