A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29).

published 2022-03-08 4y ago modified 2026-06-17 4mo ago also EUVD-2022-30878

cvss: 6.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 61%
public exploits: 0; none known

A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29). When returning the result of a completed Microflow execution call the affected framework does not correctly verify, if the request was initially made by the user requesting the result. Together with predictable identifiers for Microflow execution calls, this could allow a malicious attacker to retrieve information about arbitrary Microflow execution calls made by users within the affected system.

Patch / fix

fixed in 1

mendix mendix 7.23.29

Is CVE-2022-26317 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.96% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:P/I:N/A:N

Affected products

Siemens Mendix Applications using Mendix 7

Classification

Weakness

CWE-284 Improper Access Control
CWE-330 Use of Insufficiently Random Values

References

cert-portal.siemens.com /productcert/pdf/ssa-415938.pdf
release-notes, vendor-advisory

Sources

CVE List CVE-2022-26317
NVD CVE-2022-26317

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.