Siemens is aware of the blog post published by DIVD [1] that made a public disclosure of authorization misconfiguration in customer-owned applications built on the Mendix platform. Organizations running Mendix applications are strongly advised to immediately review their authorization configurations and assess whether any data exposure has occurred.
The identified issue is not a vulnerability in the Mendix platform itself, but rather the result of incorrect application-level authorization configurations by application owners and developers. Affected applications may expose sensitive data to anonymous or insufficiently restricted users without requiring any software exploit.
The reported findings describe a security misconfiguration observed across multiple Mendix applications, where data sources (entities) are accessible to anonymous users or newly registered users due to overly permissive authorization settings.
This is an application-level configuration issue, not a vulnerability in the Mendix platform. It can occur in any Mendix application — regardless of version or hosting environment — where authorization has not been correctly designed and enforced.
Common root causes include:
This issue is not limited to a specific Mendix version or hosting environment. It may affect:
No software exploit is required to misuse a misconfigured application. Anonymous access or a basic user account may be sufficient to retrieve data through normal Mendix runtime requests (e.g., /xas).
/xas
This makes potential abuse:
Depending on the data exposed by a misconfigured application, the potential impact includes:
Siemens strongly urges all Mendix application owners and developers to immediately review their application authorization configurations. For detailed guidance, refer to the Mendix Security Guidance [2].