CVE-2026-7891

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-7891
Rejected reason: This CVE has been retracted. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.
CVSS

No CVSS.

References

No reference.

Configurations

No configuration.

History

22 Sep 2026, 11:17

Type Values Removed Values Added
References
  • {'url': 'https://cert-portal.siemens.com/productcert/html/ssa-814963.html', 'source': 'productcert@siemens.com'}
  • {'url': 'https://csirt.divd.nl/DIVD-2026-00006/', 'source': 'productcert@siemens.com'}
  • {'url': 'https://www.divd.nl/mendix.html', 'source': 'productcert@siemens.com'}
Summary (en) A vulnerability has been identified in Mendix Runtime (All versions). Mendix documentation for access rules does not adequately describe the special behavior of the System.User entity, leaving developers without sufficient guidance to configure access rules securely. This documentation gap may lead application developers to unknowingly apply overly permissive access rules to System.User, resulting in unintended exposure of sensitive user data or privilege escalation within deployed Mendix applications. (en) Rejected reason: This CVE has been retracted. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.
CWE CWE-277
CVSS v2 : unknown
v3 : 9.1 		v2 : unknown
v3 : unknown
Information

Published : 2026-05-07 22:16

Updated : 2026-09-22 11:17

NVD link : CVE-2026-7891

Mitre link : CVE-2026-7891

CVE.ORG link : CVE-2026-7891

JSON object : View

Products Affected

No product.

CWE

No CWE.