Siemens Mendix Runtime System.User Insecure Inherited Permissions (CVE-2026-7891)

Technical Analysis

CVE-2026-7891 (CVSS 3.1: 9.1, CWE-277 Insecure Inherited Permissions) stems from Mendix's platform-enforced access rules on the System.User entity, which cannot be overridden by access rules defined on specializations of that entity, contrary to developer expectations based on prior documentation. Applications relying on XPath constraints on System.User specializations for access restriction may inadvertently expose all stored user records to anonymous or low-privileged roles. This is a low-code platform application-layer flaw rather than a memory-corruption or network-exploitable vulnerability, but exploitation requires no authentication or user interaction, only that a vulnerable Mendix app be reachable. Since Mendix is a widely used low-code application development platform, any organization exposing custom-built Mendix applications—including those used to orchestrate, monitor, or interface with AI agent or RAG pipeline backends—could leak sensitive user data or API/service credentials stored in User entities, indirectly compromising agent system security.

Affected Systems

Siemens Mendix Runtime, all versions (vers:all/*), specifically applications that define access rules on specializations of the System.User entity

Indicators of Compromise

• No specific indicators of compromise available; this is a design/documentation-based access control flaw, not an active exploit or malware campaign

Remediation Steps

1. 1

   Review Access Rule Configuration

   Audit all Mendix applications for access rules defined on System.User specializations; do not rely on XPath constraints for restricting access to this entity.

2. 2

   Enforce Role-Based Restrictions

   Move access restriction logic to the App Security role-management configuration level instead of entity-level XPath constraints.

3. 3

   Consult Updated Vendor Documentation

   Review Siemens/Mendix updated documentation clarifying platform-enforced behavior of System.User to ensure secure configuration.

4. 4

   Network Segmentation

   Minimize network exposure of Mendix-based applications, especially those in OT/ICS environments; isolate behind firewalls and avoid direct internet exposure.

5. 5

   Audit Anonymous Role Permissions

   Specifically verify that anonymous user roles do not have unintended access to System.User-derived data.