Full Report
Mendix documentation for access rules does not adequately describe the special behavior of the System.User entity, leaving developers without sufficient guidance to configure access rules securely. This documentation gap may lead application developers to unknowingly apply overly permissive access rules to System.User, resulting in unintended exposure of sensitive user data or privilege escalation within deployed Mendix applications. A common misconfiguration identified is with the anonymous user role with a System.User entity to gain access to all stored records, even though no access rights are explicitly configured on that role. Siemens recommends Mendix developers to review their access rules based on updated documentation.
Analysis Summary
# Vulnerability: Insecure Inherited Permissions in Mendix System.User Entity
## CVE Details
- **CVE ID:** CVE-2026-7891
- **CVSS Score:** 9.1 (Critical)
- **CWE:** CWE-277: Insecure Inherited Permissions
## Affected Systems
- **Products:** Mendix Runtime
- **Versions:** All versions are affected due to the underlying platform behavior and documentation gap.
- **Configurations:** Applications where developers have defined access rules on specializations of the `System.User` entity (e.g., an `Account` entity) under the assumption that these rules can override or restrict built-in platform behaviors.
## Vulnerability Description
The Mendix platform utilizes a `System.User` entity that possesses built-in, platform-enforced access rules. A documentation gap previously failed to clarify that these system-level rules cannot be overridden or restricted by access rules defined on "specializations" (inherited entities).
Because these permissions are inherited and non-restrictable via standard XPath constraints on specializations, developers may inadvertently create overly permissive environments. A specific identified risk involves the **anonymous user role**, which may gain access to all stored records within the `System.User` entity even if no explicit access rights were configured for that role by the developer.
## Exploitation
- **Status:** Not explicitly reported as exploited in the wild; however, the misconfiguration is common due to the previous documentation gap.
- **Complexity:** Low (Exploitation relies on standard platform queries against misconfigured roles).
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Unintended exposure of sensitive user data and account records).
- **Integrity:** High (Potential for privilege escalation within the deployed application).
- **Availability:** None reported.
## Remediation
### Patches
There is no "software patch" in the traditional sense, as the vulnerability stems from platform logic and developer implementation. Remediation requires manual review and configuration changes.
### Workarounds
- **Review Access Rules:** Immediately audit all access rules applied to specializations of `System.User`.
- **Logic Relocation:** Do not rely solely on XPath constraints on a `System.User` specialization to restrict access.
- **Role Management:** Enforce security restrictions at the **App Security role-management configuration level** rather than the entity level where inheritance issues occur.
- **Anonymous User Audit:** Specifically check the permissions of the anonymous user role to ensure it cannot query `System.User` records.
## Detection
- **Indicators of Compromise:** Unusual access patterns to user profile data or account entities from low-privileged or anonymous sessions.
- **Detection Methods:**
- Review Mendix Project security settings for any XPath constraints on `System.User` specializations.
- Use the Mendix Model Introspection or Security Auditor tools to identify if `System.User` data is reachable by unauthorized roles.
## References
- Siemens Security Advisory SSA-814963: hxxps://cert-portal[.]siemens[.]com/productcert/html/ssa-814963[.]html
- Mendix Updated Access Rules Documentation: hxxps://docs[.]mendix[.]com/refguide/access-rules/
- Siemens Industrial Security Guidelines: hxxps://www[.]siemens[.]com/cert/operational-guidelines-industrial-security