Mendix Runtime CVE-2026-7891 Is a Doc Gap, Not a Code Bug
Siemens won't ship a patch because the platform works as designed, yet the documentation never explained System.User's built-in access rules, and every deployed Mendix application now depends on a manual access-rule review.
TL;DR
Siemens Mendix Runtime documentation inadequately describes System.User entity behavior, creating CVE-2026-7891 (CVSS 9.1). The platform enforces built-in access rules on System.User that cannot be overridden by rules on a specialization, but developers weren't told. XPath constraints meant to restrict access are silently ineffective. Siemens updated the documentation July 14; CISA republished July 28. No patch ships. The remediation is manual: every deployed Mendix application must have its access rules reviewed and, where they rely on XPath constraints against System.User, rebuilt at the App Security role-management level.
CVE-2026-7891 is unusual: a CVSS 9.1 critical vulnerability where the flaw isn't in the code but in what the vendor forgot to document. Siemens Mendix Runtime's System.User entity has platform-enforced access rules that cannot be overridden by rules defined on a specialization. The documentation never explained this. Developers wrote XPath constraints to restrict access to user data, and the platform silently ignored them.
Siemens isn't shipping a patch because there's nothing to patch. The platform is behaving as designed. The remediation, published in updated documentation on July 14 and republished by CISA on July 28, tells developers to review every access rule in every deployed Mendix application. Restrictions that rely on XPath constraints against a System.User specialization must be rebuilt at the App Security role-management level. A particular misconfiguration keeps surfacing: the anonymous user role, when associated with a System.User entity, gains access to all stored user records even though no access rights were explicitly configured on that role.
The affected surface is every version of Mendix Runtime, V8 through V10 and all sub-versions, deployed worldwide across critical manufacturing. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) lays out the stakes: unauthenticated remote exploitation, no user interaction required, high impact to both confidentiality and integrity. For the Mendix developer, Monday means an audit, not a patch cycle. Siemens has pointed developers to its updated access-rule documentation. The work of finding every XPath-constrained System.User specialization falls to the teams that built the applications.
Published ·Deep Fathom