CVE-2026-7891: Critical severity Mendix Mendix Runtime vulnerability
Published May 7, 2026
·Updated
Rejected reason: This CVE has been retracted. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.
Affected Software
1 affected component
Mendix Mendix Runtime=All versions
Event History
May 7, 2026
CVE Published
via MITRE·09:07 PM
Rejected
via MITRE·09:07 PM
Data Sourced
via NVD·10:16 PM
Description
Sep 22, 2026
Rejected
via MITRE·10:29 AM
Frequently Asked Questions
1
What is the severity of CVE-2026-7891?
CVE-2026-7891 is considered a high severity vulnerability due to the potential for unauthorized data exposure.
2
How do I fix CVE-2026-7891?
To fix CVE-2026-7891, ensure that proper authorization controls are implemented to restrict access for anonymous users in the MyFirstModule.
3
What type of exposure does CVE-2026-7891 cause?
CVE-2026-7891 causes unintended data exposure by allowing anonymous users access to all stored records without proper access rights.
4
Which software is affected by CVE-2026-7891?
CVE-2026-7891 affects the VerySecureApp developed using Mendix Studio Pro version 11.8.0 Beta.
5
Who is the vendor responsible for CVE-2026-7891?
The vendor responsible for CVE-2026-7891 is Mendix, the creator of Mendix Studio Pro.