CVE-2021-27394
mediumpriority · track · 35EPSS 0.008 · 57 %ileDEEURUUSEPSS · scored 2026-10-27
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.19), Mendix Applications using Mendix 8 (All versions < V8.17.0), Mendix Applications using Mendix 8 (V8.12) (All versions < V8.12.5), Mendix Applications using Mendix 8 (V8.6) (All versions < V8.6.9), Mendix Applications using Mendix 9 (All versions < V9.0.5). Authenticated, non-administrative users could modify their privileges by manipulating the user role under certain circumstances, allowing them to gain administrative privileges.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedMendix Applications using Mendix 7siemens_psirt
Update your Mendix Project to V7.23.19 or later version and redeploy your application
https://docs.mendix.com/releasenotes/studio-pro/7.23 - FixedMendix Applications using Mendix 8siemens_psirt
Update your Mendix Project to V8.17.0 or later version and redeploy your application
https://docs.mendix.com/releasenotes/studio-pro/8.17 - FixedMendix Applications using Mendix 8 (V8.12)siemens_psirt
Update your Mendix Project to V8.12.5 or later and preferably the latest V8.18 version and redeploy your application
https://docs.mendix.com/releasenotes/studio-pro/8.12 - FixedMendix Applications using Mendix 8 (V8.6)siemens_psirt
Update your Mendix Project to V8.6.9 or later and preferably the latest V8.18 version and redeploy your application
https://docs.mendix.com/releasenotes/studio-pro/8.6 - FixedMendix Applications using Mendix 9siemens_psirt
Update your Mendix Project to V9.0.5 or later version and redeploy your application
https://docs.mendix.com/releasenotes/studio-pro/9.0 - FixedMendix Applications using Mendix 7cisa_csaf_ot
Update your Mendix Project to V7.23.19 or later version and redeploy your application
https://docs.mendix.com/releasenotes/studio-pro/7.23 - FixedMendix Applications using Mendix 8cisa_csaf_ot
Update your Mendix Project to V8.17.0 or later version and redeploy your application
https://docs.mendix.com/releasenotes/studio-pro/8.17 - FixedMendix Applications using Mendix 8 (V8.12)cisa_csaf_ot
Update your Mendix Project to V8.12.5 or later and preferably the latest V8.18 version and redeploy your application
https://docs.mendix.com/releasenotes/studio-pro/8.12 - FixedMendix Applications using Mendix 8 (V8.6)cisa_csaf_ot
Update your Mendix Project to V8.6.9 or later and preferably the latest V8.18 version and redeploy your application
https://docs.mendix.com/releasenotes/studio-pro/8.6 - FixedMendix Applications using Mendix 9cisa_csaf_ot
Update your Mendix Project to V9.0.5 or later version and redeploy your application
https://docs.mendix.com/releasenotes/studio-pro/9.0 - MitigationMendix Applications using Mendix 7siemens_psirt
Remove the privilege to manage user roles for non-administrative roles to mitigate this vulnerability for non-administrative users
- MitigationMendix Applications using Mendix 8siemens_psirt
Remove the privilege to manage user roles for non-administrative roles to mitigate this vulnerability for non-administrative users
- MitigationMendix Applications using Mendix 8 (V8.12)siemens_psirt
Remove the privilege to manage user roles for non-administrative roles to mitigate this vulnerability for non-administrative users
- MitigationMendix Applications using Mendix 8 (V8.6)siemens_psirt
Remove the privilege to manage user roles for non-administrative roles to mitigate this vulnerability for non-administrative users
- MitigationMendix Applications using Mendix 9siemens_psirt
Remove the privilege to manage user roles for non-administrative roles to mitigate this vulnerability for non-administrative users
- MitigationMendix Applications using Mendix 7cisa_csaf_ot
Remove the privilege to manage user roles for non-administrative roles to mitigate this vulnerability for non-administrative users
- MitigationMendix Applications using Mendix 8cisa_csaf_ot
Remove the privilege to manage user roles for non-administrative roles to mitigate this vulnerability for non-administrative users
- MitigationMendix Applications using Mendix 8 (V8.12)cisa_csaf_ot
Remove the privilege to manage user roles for non-administrative roles to mitigate this vulnerability for non-administrative users
- MitigationMendix Applications using Mendix 8 (V8.6)cisa_csaf_ot
Remove the privilege to manage user roles for non-administrative roles to mitigate this vulnerability for non-administrative users
- MitigationMendix Applications using Mendix 9cisa_csaf_ot
Remove the privilege to manage user roles for non-administrative roles to mitigate this vulnerability for non-administrative users
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–8.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (30)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- SSA-875726SSA-875726: Privilege Escalation Vulnerability in Mendix2021-04-14csaf · siemens_psirtDE
The latest updates for Mendix fix a vulnerability in Mendix Applications that could allow malicious authorized users to escalate their privileges. Mendix has released an update for Mendix and recommends to update to the latest version.
- ICSA-21-110-07Siemens Mendix2021-04-14icsa · cisa_csaf_otUS
The latest updates for Mendix fix a vulnerability in Mendix Applications that could allow malicious authorized users to escalate their privileges. Mendix has released an update for Mendix and recommends to update to the latest version.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://cert-portal.siemens.com/productcert/pdf/ssa-875726.pdfcnnvd
- https://cert-portal.siemens.com/productcert/txt/ssa-875726.txtPatchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-27394cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-110-07cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021041513cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-875726.pdfenisa_euvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-875726.pdfVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan