CVE-2026-7891

Mendix Studio Pro for the anonymous user role applies a permission inheritance mechanism (user inheritance rules) without explicitly informing developers about it in the documentation. As a result, anonymous users of the MyFirstModule module gain access to all records stored in the application, even though no permissions have been explicitly configured for this role. The vulnerability only requires the Mendix entity to be publicly available — which is a standard step when building an application. An unauthenticated attacker can thus read and modify data without any additional prerequisites.

An unauthenticated attacker can gain unauthorized access to read and modify all records stored in an application built on the vulnerable version of Mendix Studio Pro. This results in potential exposure of sensitive data and the possibility of its unauthorized modification.

Apply patches available from the vendor according to the references (https://csirt.divd.nl/DIVD-2026-00006/ and https://www.divd.nl/mendix.html). Until the update is applied, verify the permission configuration for the anonymous user role in all application modules and explicitly restrict access to entities so that anonymous users cannot view or modify data.

All versions of Mendix Studio Pro up to and including 11.8.0 Beta — applications built with a module containing publicly available entities and an anonymous user role configured.