Mercator has a Personal Identifiable Information Leak from Query Executor feature

An authenticated attacker with any role (including the read-only Auditor role) sends a crafted JSON DSL payload to the `/admin/queries/execute` endpoint. Because no authorization gate is enforced, the attacker can query models beyond their intended scope, including the `User` model. By using the `password` column in `LIKE` filter predicates and observing the `meta.count` in responses, the attacker can progressively reconstruct a bcrypt hash character by character [ref_id=1]. Exploitation requires a valid Mercator account and direct network access to the application (AT:N) [ref_id=1].

The controller method `QueryController::execute()` (line 133) does not enforce an authorization gate, unlike `store()` and `massDestroy()` which correctly call `abort_if(Gate::denies(...))`. The `schema()` and `schemaModel()` endpoints are similarly unguarded. The `password` column, though declared `$hidden` on the `User` model, is not excluded from filter predicates, allowing it to be used in `LIKE` conditions.

The advisory states that version 2025.05.19 patches the issue [ref_id=1]. The patch is expected to add an authorization gate (e.g., `abort_if(Gate::denies(...))`) to `QueryController::execute()`, `schema()`, and `schemaModel()`, mirroring the protection already present in `store()` and `massDestroy()`. Additionally, the `password` column should be excluded from filter predicates to prevent its use in `LIKE` conditions.