Siemens issued a critical security advisory on July 14, 2026, for all versions of Mendix Runtime, warning that a long-standing documentation gap can cause deployed applications to expose user accounts and enable privilege escalation. The vulnerability, tracked as CVE-2026-7891 and scored 9.1 under both CVSS v3.1 and CVSS v4.0, stems from the fact that Mendix’s built-in access controls for the System.User entity override any XPath restrictions a developer places on specialized account entities — a behavior that, until now, was not clearly documented.

This is not a patch-and-forget bug. Siemens’ remediation is a mandate for developers to audit their application’s role-management configuration, because the runtime’s special treatment of System.User means that even carefully crafted XPath filters cannot actually limit access to user data if the user role’s “manageable roles” are set too broadly. Anonymous user roles present the most acute danger: they can gain access to all stored records even when no explicit rights are configured.

What Actually Happened

The core of CVE-2026-7891 is a mismatch between how Mendix developers intuitively secure their domain models and how the runtime enforces permissions on the System.User entity. In a typical Mendix app, entity access rules control whether a module role can create, read, write, or delete objects, and XPath constraints can further limit which specific objects are affected. The rules are additive — if multiple rules grant access, the combined result is applied.

System.User, however, breaks that pattern. The platform automatically includes a System module that manages user and user role entities. Any account entity in your app — including the common Administration.Account specialization — is actually a specialization of System.User. Mendix’s updated documentation now explicitly states that System.User has built-in access rules that grant access to its attributes when a user’s role is allowed to manage the target user’s role. Crucially, these platform rules apply to all specializations and cannot be overridden by access rules or XPath constraints defined on the specialization itself.

A concrete example: You create a custom employee account entity that specializes System.User. To restrict department managers to only see accounts from their own department, you add an XPath constraint on the specialization’s read access rule: [Department = $currentUser/Department]. In the domain model editor, this looks correct. But at runtime, if the manager role’s user management properties allow it to manage employee user roles, the platform’s System.User rules will grant read access to all accounts, regardless of the XPath filter. The filter becomes irrelevant for any user whose role has the “manageable roles” permission over those accounts.

Siemens’ advisory explicitly warns that anonymous user roles are particularly dangerous. If your app enables anonymous access and that anonymous role is associated with a System.User entity, the built-in platform rules can grant the anonymous user visibility into all stored records — even if no access rules were configured for that role at all.

What It Means for Your Mendix Apps

The impact splits along three audiences:

For Application Developers and Architects

If you’ve ever applied XPath constraints to a System.User specialization — for example, to enforce tenant isolation, departmental boundaries, or customer self-service data scoping — you must assume those constraints are not effective for controlling access to user record attributes. The real authorization boundary is set by which user roles each application role is allowed to manage in the App Security settings. Any developer who treated XPath as the primary defense for user data has likely built an overly permissive authorization model.

The exposed data can include account identifiers, display names, email addresses, role assignments, organizational metadata, and associations to sensitive business records. This is a pivot point for further attacks: knowing which users have admin roles, discovering valid account names, or inferring organizational structure all become possible from a single misconfiguration.

For Enterprise IT and Self-Managed Mendix Runtimes

Teams running Mendix on Windows servers — often integrated with Active Directory, Microsoft Entra ID, or line-of-business databases — are not immune simply because they host the runtime themselves. The vulnerability lives in the platform logic, not in a network service. If your deployment uses custom user specializations with XPath limits, you need to audit every application role’s “manageable roles” setting immediately. The advisory applies globally to all Mendix Runtime versions, so there is no version upgrade to wait for.

For Anonymous and Public-Facing Apps

Any Mendix application that enables anonymous users and includes a System.User specialization is at immediate risk of exposing all user records to unauthenticated visitors. Even if your anonymous role appears to have no read access on paper, the platform-level System.User rules can grant access when the anonymous role is associated with user management capabilities. Siemens singles out this scenario as a common misconfiguration that requires urgent review.

The CVSS vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N confirms network reachability, low attack complexity, no privileges required, and no user interaction — meaning an internet-facing app with anonymous access could be exploited by anyone who discovers the vulnerable endpoint.

How We Got Here

Mendix’s security model for ordinary business entities is well understood: specializations require their own explicit access rules, and generalization-level rules don’t automatically carry over as restrictive boundaries. That’s a deliberate design to prevent unexpected permission inheritance. But System.User has always been an exception — the platform must manage the fundamental identity object with special privileges to support authentication, role assignment, and user lifecycle operations. The problem is that this exceptional behavior was never clearly documented as overriding developer-defined XPath constraints.

The advisory itself (SSA-814963 from Siemens ProductCERT) describes this as a “documentation gap” leading to developers “unknowingly applying overly permissive access rules.” Over time, as Mendix applications scaled into multi-tenant, customer-facing, and enterprise-integrated scenarios, the gap became a critical security boundary flaw. The common pattern of using XPath to implement departmental or tenant isolation on user records looked safe in Studio Pro’s visual editor but failed at runtime because the effective permission was always controlled by the role-management configuration — a setting often left at the default “All” for administrators or overlooked entirely during security reviews.

How to Secure Your Deployments

Siemens does not offer a software patch for CVE-2026-7891. The fix is a systematic review of your application’s authorization model. Here’s where to start:

  1. Inventory every System.User specialization — Identify all entities that directly or indirectly specialize System.User, including custom account entities and any Administration.Account variants. For each, note all XPath constraints currently applied to access rules.

  2. Audit user management properties — In the App Security section of Mendix Studio Pro, for every user role, inspect the list of manageable roles. Switch any role that uses “All” to a minimal set of selected roles. If a role should not manage any users, ensure no roles are selected. This is your new primary enforcement point for user-record segmentation.

  3. Treat anonymous access as a red alert — If your app enables the anonymous user role, verify immediately: is that role associated with any System.User entity in a way that could trigger the platform’s built-in rules? Remove anonymous association with user management capabilities entirely, or at the very least, restrict manageable roles to an empty set. Test with unauthenticated requests to confirm that no user data is visible.

  4. Redesign your authorization architecture — Stop relying on XPath alone to restrict visibility of user records. Instead, move that logic to the App Security role-management level. For example, a department manager who should only administer ordinary employee accounts must have their manageable roles limited to exactly those employee roles, not “All” and not admin roles. Separate business profile data (department, manager, contact info) from the user account entity: store those in dedicated entities where normal XPath rules work as expected.

  5. Test with role-specific accounts — Don’t validate with an administrator account. Create test users representing each trust boundary: an anonymous visitor, a standard authenticated user, a department manager, a tenant admin, and a full system administrator. For each, attempt to view or edit user records they should not have access to, both through the UI and through any published APIs (REST, OData, etc.). Confirm that role-management restrictions actually block access, not just the XPath filters you previously relied on.

  6. Use the Security Overview as a supplement, not the answer — Mendix’s Security Overview tool can aggregate effective permissions for a given user role, but it does not display the System module or reflect the special platform rules for System.User. Never treat a clean Overview as proof that your user data is safe.

A concise rule of thumb: Every user role should be allowed to manage only the smallest viable set of other user roles. XPath on System.User specializations is defense in depth at best, never the primary control.

Looking Ahead

CVE-2026-7891 is a wake-up call for low-code platform security. It demonstrates that visual rule editors and declarative constraints can hide platform-level exceptions that silently defeat a developer’s intent. Mendix’s updated documentation now explains the System.User special case directly, which will help teams building new applications from scratch. But for the thousands of existing Mendix applications already in production, the burden is on individual organizations to hunt down this authorization blind spot.

Enterprise teams should incorporate a “System.User specialization review” into their regular security assessment cycles, paying particular attention to any integration with external identity providers, tenant isolation logic, or customer self-service portals. The advisory’s mitigation — revoking broad user management permissions and separating identity administration from business data — is a durable improvement that strengthens the overall security posture far beyond this single CVE.