Misconfigured authorization settings expose sensitive data across 2,000 global Mendix application systems
Misconfigured authorization settings in Mendix applications have exposed highly sensitive data across more than 2,000 systems globally. This is not a flaw in the Mendix platform itself, but rather a documentation gap regarding how developers must handle the `System.User` entity. Organizations should immediately audit their application access rules and check logs for unauthorized activity.
Summary
A widespread misconfiguration in Mendix-based applications has left sensitive information-including financial records, medical data, and identity documents-vulnerable to unauthorized access. Researchers have identified over 2,000 reachable systems worldwide that are currently affected by these authorization errors. The issue stems from how developers configure access rules for the System.User entity, which can lead to full database exposure even when no explicit permissions are set for anonymous users.
The impact varies significantly depending on the specific application. In one instance involving a non-Dutch application, 650,000 identity documents were found to be accessible. Other discovered cases involved the modification of financial transaction recipient details and the exposure of personal contract or medical information.
What happened
The vulnerability arises from incomplete documentation regarding the System.User entity within the Mendix Runtime. Because developers are not fully informed on how this entity behaves, they may inadvertently apply overly permissive access rules.
A common misconfiguration involves assigning an anonymous user role to a System.User specialization. This can grant access to all stored records within an application, even if no explicit access rights have been configured for that role. In some scenarios, researchers found that after a user registers and activates an account, the entire database becomes visible.
Technical details
The core of the issue lies in the authorization logic used during application development. While Mendix is a high- productivity platform for building mobile and web applications, the security model requires specific configurations to prevent data leaks.
The vulnerability, tracked as CVE-2026-7891 (CVSS 9.1), centers on the System.User entity. Current documentation does not adequately describe its special behavior, leading developers to create security models that fail to restrict access properly. This can result in privilege escalation or unintended data exposure for both internal and external applications.
Why this matters for defenders
The scale of this issue is significant. Researchers have identified more than 2,000 systems across various sectors, including government agencies, municipalities, banks, healthcare institutions, universities, and car dealerships.
Because the vulnerability exists at the application configuration level rather than the platform level, standard software patching may not resolve the risk. Defenders must manually review how their specific applications handle user roles and data access.
Defender guidance
Organizations using Mendix should take the following actions to mitigate risk:
- Audit Access Rules: Review all Mendix application configurations, specifically looking at how
System.Userspecializations are handled. Do not rely solely on XPath constraints for these entities. - Enforce Role-Management: Shift security enforcement to the App Security role-management configuration level rather than relying on individual entity restrictions.
- Verify Anonymous Access: Check whether anonymous visitors can access sensitive data, and more importantly, verify what becomes visible once a user logs in or registers an account.
- Inspect Infrastructure: Use tools such as
Menscan.ioorMendixHunterto check your infrastructure for these specific misconfigurations. - Review Logging: Examine application logs for patterns of unauthorized access or unusual data retrieval behavior.
- Update Security Files: Ensure your organization has an up-to-date
security.txtfile on its website to facilitate communication with security researchers.
What remains unclear
While the scope of the issue is large, the full extent of the impact is still being determined as investigations continue. It is not yet known how many more systems are currently vulnerable or if these misconfigurations have been actively exploited by malicious actors for data exfiltration or financial fraud.
Sources
