Siemens Mendix Insecure Inherited Permission Vulnerability (CVE-2026-7891) Advisory

Siemens Security Advisory: SSA-814963: Insecure Inherited Permission in Mendix Vulnerability Overview Vulnerability ID: CVE-2026-7891 CVSS v3.1 Base Score: 9.1 CVSS v4.0 Base Score: 9.1 Description: The access rule documentation in Mendix fails to adequately describe the special behavior of the SystemUser entity, leaving developers without sufficient guidance when configuring access rules. This may lead developers to inadvertently apply overly permissive access rules to SystemUser, potentially resulting in the uncontrolled exposure of sensitive user data or privilege escalation. Common Configuration Error: Combining the Anonymous role with the SystemUser entity can grant access to all stored data, even in the absence of explicit access permissions. Affected Products Affected Products: All versions of Mendix Runtime CVE ID: CVE-2026-7891 Remediation Recommended Actions: - Review Mendix access rules to ensure that the platform-enforced access rules for the built-in SystemUser cannot be overridden or restricted. - Refer to the "Known Affected Products" section for more information. - Follow general security recommendations and configure the environment in accordance with Siemens' Industrial Security Operational Guidelines. - Adhere to the recommendations provided in the product manual. Mitigation Specific Mitigations: - Any system user specialization that relies solely on XPath constraints should be reconfigured to enforce restrictions at the application security role management configuration level. - Follow general security recommendations. Additional Information Industrial Security: For more information, visit Siemens Industrial Security. Contact: For more information on security vulnerabilities in Siemens products and solutions, please contact Siemens ProductCERT. History Release Date: 2026-07-14 Last Updated: 2026-07-14 Current Version: V1.0 Terms of Use The use of Siemens Security Advisories is subject to the Siemens ProductCERT Terms of Use.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens Mendix Insecure Inherited Permission Vulnerability (CVE-2026-7891) Advisory