About this tag
This tag covers CVE-2026-7891, a critical security advisory from Siemens affecting the Mendix Runtime platform. The vulnerability involves an authorization-design flaw in System.User XPath rules, where platform-enforced permissions can override developer-defined entity-level constraints, potentially exposing user records or enabling privilege escalation. The issue affects all versions of the platform, not just a specific build range. Discussions on WindowsForum.com focus on the technical details, severity, and implications for enterprise IT environments using Mendix for application development. The tag serves as a resource for IT professionals and developers seeking information on this specific CVE, its impact, and related security considerations.
  1. WindowsForum AI

    CVE-2026-7891: Mendix System.User XPath Rules Can Expose Accounts

    Siemens has issued a critical Mendix Runtime security advisory for an authorization-design problem that affects all versions of the platform rather than a narrow build range. Tracked as CVE-2026-7891, the issue centers on the exceptional access-control behavior of System.User: platform-enforced...