# Siemens Mendix Flaw Lets Anonymous Users Access All Records — And the Docs Never Said Not to


## The Threat


There's a particular kind of vulnerability that's harder to patch than a buffer overflow: one that lives in the documentation. Siemens has disclosed a critical flaw in Mendix Runtime — not a bug in the code per se, but a gap in guidance that has left an untold number of low-code application developers unknowingly configuring their apps to expose every user record stored in the system.


The root of the problem is System.User, a built-in Mendix entity with platform-enforced access rules that behave differently from standard entities. When developers create a specialization of System.User and apply XPath constraints to restrict access, those constraints don't work the way they'd expect. The platform's built-in rules for System.User can't be overridden at the specialization level — meaning any access restrictions applied there are silently ignored. The upstream documentation never made this clear.


The most damaging misconfiguration Siemens has identified: assigning the anonymous user role to a System.User specialization. An unauthenticated visitor then gains read access to all stored user records, even though no explicit access rights were configured on the anonymous role. Developers followed the documentation. The documentation was wrong. And somewhere out there, Mendix apps are silently serving up their entire user databases to anyone who asks.


## Severity and Impact


| Field | Detail |

|---|---|

| CVE | CVE-2026-7891 |

| CVSS Score | 9.1 (Critical) |

| CVSS Version | 3.1 |

| Vector String | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |

| Attack Complexity | Low |

| Authentication Required | None |

| User Interaction | None |

| Confidentiality Impact | High |

| Integrity Impact | High |

| CWE | CWE-277 — Insecure Inherited Permissions |


The 9.1 score reflects the worst-case configuration: network-accessible, no authentication, no user interaction required, and high impact on both confidentiality and integrity. This is a fire-and-forget exposure for any attacker who knows what to probe.


## Affected Products


  • Siemens Mendix Runtime — all versions (no version boundary; the issue is architectural and present across the platform)

    • Siemens ProductCERT reported this vulnerability to CISA. Deployment scope is worldwide, with critical manufacturing identified as the primary affected infrastructure sector.


    ## Mitigations


    Siemens has not issued a patched runtime version — the remediation is developer-side, not platform-side. Every team running a Mendix application that uses System.User specializations needs to audit their access model now.


    Immediate actions:


  • Audit all access rules involving System.User specializations. Any XPath constraints applied at the specialization level should be treated as non-functional until verified.
  • Shift access control to role management. Do not rely on XPath constraints on a System.User specialization to restrict access. Restrictions must be enforced at the App Security role-management configuration level instead.
  • Check the anonymous user role specifically. If your app allows anonymous access, verify whether any System.User specialization is associated with that role. This is the configuration Siemens identified as the most commonly exploited path.
  • Review Mendix's updated documentation on System.User behavior — the platform's built-in access rules are now documented, and developers should re-read them with the understanding that specialization-level overrides do not apply.
  • Network hardening. CISA recommends the standard industrial control posture: remove Mendix deployments from direct internet exposure, place them behind firewalls, isolate from business networks, and use VPN for any required remote access.

    • There is no firmware update or patch to apply here. The fix is a code and configuration review — which means it requires developer time, not just an update cycle.


    ## References


  • [Siemens ProductCERT Advisory](https://www.siemens.com/cert/advisories)
  • [CISA ICS Advisory](https://www.cisa.gov/ics-advisories)
  • [Siemens Industrial Security Operational Guidelines](https://www.siemens.com/cert/operational-guidelines-industrial-security)
  • [Siemens Industrial Security Portal](https://www.siemens.com/industrialsecurity)
  • [CISA Privacy & Use Policy](https://www.cisa.gov/privacy-policy)

    • ---


    ## HackWire Analysis


    The 9.1 CVSS score will dominate the headlines, but the more interesting story here is what this vulnerability says about the risk model for low-code platforms.


    Mendix is not a hobbyist tool. It's enterprise-grade, widely deployed across manufacturing and critical infrastructure, and marketed to business developers who may not have a traditional security engineering background. That's the point. The promise of low-code is that developers can build powerful apps without deep platform knowledge. But System.User's special inheritance behavior is exactly the kind of thing a low-code developer would never think to question — especially when the documentation didn't surface it.


    This is CWE-277 (Insecure Inherited Permissions) playing out at the platform abstraction layer, not just in a single codebase. Every developer who read the docs and followed them correctly may still be exposed. That's a systemic trust failure, and it puts Siemens in a difficult position: they can update the documentation, but they can't easily tell which deployed applications were built under the old guidance. The audit burden falls entirely on customer teams who may not even know to look.


    The anonymous-user path is the one defenders should prioritize first. Any publicly accessible Mendix app — a customer portal, a supplier interface, a field service tool — that touched System.User in its security model is worth examining before you read anything else today. In critical manufacturing environments especially, "all stored user records" may include credentials, contact information, or role assignments that compound into a much larger breach surface.


    Low-code platforms will keep gaining enterprise ground. Expect more vulnerabilities like this one: not in the runtime engine, but in the gap between what the platform promises and what the documentation actually explains.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)