CVE-2026-7891: Critical severity Mendix Mendix Runtime vulnerability

Published May 7, 2026

Updated

A vulnerability has been identified in Mendix Runtime (All versions). Mendix documentation for access rules does not adequately describe the special behavior of the System.User entity, leaving developers without sufficient guidance to configure access rules securely. This documentation gap may lead application developers to unknowingly apply overly permissive access rules to System.User, resulting in unintended exposure of sensitive user data or privilege escalation within deployed Mendix applications.

Affected Software

1 affected component

Mendix Mendix Runtime=All versions

Event History

May 7, 2026

CVE Published

via MITRE·09:07 PM

Data Sourced

via MITRE·09:07 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-7891?

CVE-2026-7891 is considered a high severity vulnerability due to the potential for unauthorized data exposure.

How do I fix CVE-2026-7891?

To fix CVE-2026-7891, ensure that proper authorization controls are implemented to restrict access for anonymous users in the MyFirstModule.

What type of exposure does CVE-2026-7891 cause?

CVE-2026-7891 causes unintended data exposure by allowing anonymous users access to all stored records without proper access rights.

Which software is affected by CVE-2026-7891?

CVE-2026-7891 affects the VerySecureApp developed using Mendix Studio Pro version 11.8.0 Beta.

Who is the vendor responsible for CVE-2026-7891?

The vendor responsible for CVE-2026-7891 is Mendix, the creator of Mendix Studio Pro.