What is CVE-2021-42026?

CVE-2021-42026 is a medium-severity vulnerability in Mendix, classified under Incorrect Authorization. CVSS score: 4.3/10. Published 2021-11-09.

How severe is CVE-2021-42026?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Mendix

CVE-2021-42026

A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2). Applications built with affected versions of Mendix Studio Pro do not properly control read access for certain client actions. This could allow authenticated attackers to retrieve the changedDate attribute of arbitrary objects, even when they don't have read access to them.

Vulnerability class: Broken Access Control

EPSS: 0.005 (42.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Mendix
Siemens Mendix Applications Using 8 — versions All versions < V8.18.13
Siemens Mendix Applications Using 9 — versions All versions < V9.6.2

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

productcert@siemens.com (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-42026?: CVE-2021-42026 is a medium-severity vulnerability in Mendix, classified under Incorrect Authorization. CVSS score: 4.3/10. Published 2021-11-09.
How severe is CVE-2021-42026?: Medium severity. CVSS v3 base score is 4.3 out of 10.