Siemens Mendix Runtime

A critical vulnerability (CVE-2026-7891) has been identified in Siemens Mendix Runtime affecting all versions. The issue stems from inadequate documentation for access rules related to the System.User entity, which can lead developers to apply overly permissive access configurations. This misconfiguration can result in unintended exposure of sensitive user data or privilege escalation within deployed Mendix applications. A common misconfiguration involves the anonymous user role gaining access to all stored records via System.User even without explicit access rights. The vulnerability scores a CVSS v3.1 base score of 9.1 (CRITICAL) with network-accessible attack vector requiring no privileges or user interaction. Siemens recommends developers review access rules, enforce restrictions at the App Security role-management level, and consult updated documentation. CISA republished this advisory from Siemens ProductCERT SSA-814963 to increase visibility.