PT-2026-38589 · Mendix · Mendix Studio Pro

Divd · Published 2026-05-07 · Updated 2026-05-10 · CVE-2026-7891

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Mendix Studio Pro versions prior to 11.8.0 Beta

Description An authorization misconfiguration in the software allows unintended data exposure. Specifically, users with the anonymous user role in the MyFirstModule can gain access to all stored records, even when no access rights are explicitly configured for that role. This occurs because the software silently applies user inheritance rules to the anonymous user role, a behavior not explicitly detailed in the documentation.

Recommendations Update to a version later than 11.8.0 Beta.

Fix

Weakness Enumeration

CWE-277

Related Identifiers

CVE-2026-7891

Affected Products

Mendix Studio Pro

References · 5

• https://csirt.divd.nl/DIVD-2026-00006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7891 · Security Note
• https://t.me/CVEtracker/53042 · Telegram Post
• https://twitter.com/CVEnew/status/2053559193412509881 · Twitter Post
• https://divd.nl/mendix.html · Note