cve-2026-7891
opencve
Description
Rejected reason: This CVE has been retracted. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.
Timeline
- Published
- 2026-05-07 22:16 UTC
- Last Modified
- 2026-09-22
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"cve": "CVE-2026-7891",
"enrichment": {
"affected": [
{
"configurations": [
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "semver",
"value": "[0,1.1.0]"
}
}
],
"enrichment": {
"confidence": 100.0,
"confidence_source": "cna",
"scores": [
{
"score": 100.0,
"source": "cna"
}
]
},
"original": {
"product": "VerySecureApp",
"source": "cna",
"vendor": "DIVD"
},
"product": "verysecureapp",
"vendor": "divd"
}
],
"created": "2026-05-07T22:30:36.244734+00:00",
"updated": "2026-07-31T18:00:08.114729+00:00",
"vendors": [
"divd",
"divd$PRODUCT$verysecureapp"
]
},
"epss": {},
"mitre": {
"cpes": [],
"created": "2026-05-07T21:07:22.206000+00:00",
"description": "This CVE has been retracted. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {}
},
"mitre_repo_path": "cves/2026/7xxx/CVE-2026-7891.json",
"references": [],
"title": null,
"updated": "2026-09-22T10:29:24.756000+00:00",
"vendors": [],
"weaknesses": []
},
"nvd": {
"cpes": [],
"created": "2026-05-07T22:16:37.070000+00:00",
"description": "Rejected reason: This CVE has been retracted. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {}
},
"nvd_repo_path": "2026/CVE-2026-7891.json",
"references": [],
"title": null,
"updated": "2026-09-22T11:17:25.527000+00:00",
"vendors": [],
"weaknesses": []
},
"opencve": {
"changes": [
{
"created": "2026-05-07T21:30:00+00:00",
"data": [
{
"details": {
"new": "The VerySecureApp made by DIVD using Mendix Studio Pro 11.8.0 Beta allows unintended data exposure due to authorization misconfiguration. The VerySecureApp allows anonymous users of the MyFirstModule with the anonymous user role to gain access to all stored records, even though no access rights are explicitly configured on that role. Anonymous users are required to make a Mendix Entity available publicly. All versions of Mendix Studio Pro up to 11.8.0 Beta silently make an Anonymous user role follow user inheritance rules, without mentioning this explicitly in the documentation.",
"old": null
},
"type": "description"
},
{
"details": {
"added": [
"CWE-277"
],
"removed": []
},
"type": "weaknesses"
},
{
"details": {
"added": [
"https://csirt.divd.nl/DIVD-2026-00006/",
"https://www.divd.nl/mendix.html"
],
"removed": []
},
"type": "references"
},
{
"details": {
"added": {
"cvssV4_0": {
"score": 9.3,
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:A"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "7bbd3769-f5f7-41c4-8bb9-3e0ed735fa50"
},
{
"created": "2026-05-07T22:45:00+00:00",
"data": [
{
"details": {
"new": "Authorization Misconfiguration Allowing Anonymous Data Exposure in VerySecureApp",
"old": null
},
"type": "title"
}
],
"id": "60abd5d7-0c23-41ae-8daf-3aac069b4368"
},
{
"created": "2026-05-08T14:15:00+00:00",
"data": [
{
"details": {
"added": {
"ssvc": {
"options": {
"Automatable": "yes",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "e6a51b4e-8310-4ad9-8c01-d368665fadd2"
},
{
"created": "2026-05-10T21:45:00+00:00",
"data": [
{
"details": [
"divd",
"divd$PRODUCT$verysecureapp"
],
"type": "first_time"
},
{
"details": {
"added": [
"divd",
"divd$PRODUCT$verysecureapp"
],
"removed": []
},
"type": "vendors"
}
],
"id": "a8fa00ac-7096-4175-951b-4d361010198c"
},
{
"created": "2026-07-14T10:00:00+00:00",
"data": [
{
"details": {
"new": "A vulnerability has been identified in Mendix Runtime (All versions). Mendix documentation for access rules does not adequately describe the special behavior of the System.User entity, leaving developers without sufficient guidance to configure access rules securely. This documentation gap may lead application developers to unknowingly apply overly permissive access rules to System.User, resulting in unintended exposure of sensitive user data or privilege escalation within deployed Mendix applications.",
"old": "The VerySecureApp made by DIVD using Mendix Studio Pro 11.8.0 Beta allows unintended data exposure due to authorization misconfiguration. The VerySecureApp allows anonymous users of the MyFirstModule with the anonymous user role to gain access to all stored records, even though no access rights are explicitly configured on that role. Anonymous users are required to make a Mendix Entity available publicly. All versions of Mendix Studio Pro up to 11.8.0 Beta silently make an Anonymous user role follow user inheritance rules, without mentioning this explicitly in the documentation."
},
"type": "description"
},
{
"details": {
"added": [
"https://cert-portal.siemens.com/productcert/html/ssa-814963.html"
],
"removed": []
},
"type": "references"
},
{
"details": {
"added": {
"cvssV3_1": {
"score": 9.1,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
},
"removed": {},
"updated": {
"cvssV4_0": {
"new": {
"score": 9.1,
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
},
"old": {
"score": 9.3,
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:A"
}
}
}
},
"type": "metrics"
}
],
"id": "337b9a69-d187-4232-a96a-2bdcddf113f8"
},
{
"created": "2026-07-17T16:15:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Authorization Misconfiguration Allowing Anonymous Data Exposure in VerySecureApp"
},
"type": "title"
}
],
"id": "a601e8fe-5b51-456d-a569-1d3c7fccea0e"
},
{
"created": "2026-07-27T04:45:00+00:00",
"data": [
{
"details": {
"new": "Documentation Gap in Mendix Runtime Allows Overly Permissive Access to System.User",
"old": null
},
"type": "title"
}
],
"id": "f526caaa-5f0a-46af-9345-db60b86e5fff"
},
{
"created": "2026-07-31T18:15:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Documentation Gap in Mendix Runtime Allows Overly Permissive Access to System.User"
},
"type": "title"
}
],
"id": "e32c13de-f341-42e2-939a-23bbf8e5fee2"
},
{
"created": "2026-09-22T10:45:00+00:00",
"data": [
{
"details": {
"new": "This CVE has been retracted. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.",
"old": "A vulnerability has been identified in Mendix Runtime (All versions). Mendix documentation for access rules does not adequately describe the special behavior of the System.User entity, leaving developers without sufficient guidance to configure access rules securely. This documentation gap may lead application developers to unknowingly apply overly permissive access rules to System.User, resulting in unintended exposure of sensitive user data or privilege escalation within deployed Mendix applications."
},
"type": "description"
},
{
"details": {
"added": {},
"removed": {},
"updated": {
"cvssV4_0": {
"new": {
"score": 9.1,
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
},
"old": {
"score": 9.1,
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
}
}
}
},
"type": "metrics"
}
],
"id": "54027dd3-d55b-4980-a7c4-bd05caa9a569"
},
{
"created": "2026-09-22T11:30:00+00:00",
"data": [
{
"details": {
"added": [],
"removed": [
"CWE-277"
]
},
"type": "weaknesses"
},
{
"details": {
"added": [],
"removed": [
"https://cert-portal.siemens.com/productcert/html/ssa-814963.html",
"https://csirt.divd.nl/DIVD-2026-00006/",
"https://www.divd.nl/mendix.html"
]
},
"type": "references"
},
{
"details": {
"added": {},
"removed": {
"cvssV3_1": {
"score": 9.1,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
"cvssV4_0": {
"score": 9.1,
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
},
"ssvc": {
"options": {
"Automatable": "yes",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"updated": {}
},
"type": "metrics"
}
],
"id": "8ccb32cf-9921-4a53-b30e-9c90438c8437"
}
],
"cpes": {
"data": [],
"providers": []
},
"created": {
"data": "2026-05-07T21:07:22.206000+00:00",
"provider": "mitre"
},
"description": {
"data": "This CVE has been retracted. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.",
"provider": "mitre"
},
"metrics": {
"cvssV2_0": {
"data": {},
"provider": null
},
"cvssV3_0": {
"data": {},
"provider": null
},
"cvssV3_1": {
"data": {},
"provider": null
},
"cvssV4_0": {
"data": {},
"provider": null
},
"epss": {
"data": {},
"provider": null
},
"kev": {
"data": {},
"provider": null
},
"ssvc": {
"data": {},
"provider": null
},
"threat_severity": {
"data": null,
"provider": null
}
},
"references": {
"data": [],
"providers": []
},
"title": {
"data": null,
"provider": null
},
"updated": {
"data": "2026-09-22T11:17:25.527000+00:00",
"provider": "nvd"
},
"vendors": {
"data": [
"divd",
"divd$PRODUCT$verysecureapp"
],
"providers": [
"enrichment"
]
},
"weaknesses": {
"data": [],
"providers": []
}
},
"vulnrichment": {
"cpes": [],
"created": "2026-05-07T21:07:22.206000+00:00",
"description": "This CVE has been retracted. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {},
"kev": {},
"ssvc": {}
},
"references": [],
"title": null,
"updated": "2026-09-22T10:29:24.756000+00:00",
"vendors": [],
"vulnrichment_repo_path": "2026/7xxx/CVE-2026-7891.json",
"weaknesses": []
}
}