Siemens Mendix Runtime

Mendix documentation inadequately describes the special behavior of the System.User entity and how access rules inherit permissions, leaving developers without sufficient guidance to configure access rules securely. This documentation gap commonly results in misconfigured access rules that unintentionally expose sensitive user data or enable privilege escalation. A known misconfiguration is granting the anonymous user role access to System.User records, allowing unauthorized access to all stored user data. The root cause is that System.User has built-in platform-enforced access rules that cannot be overridden or restricted by access rules defined on specializations of that entity. Developers must review access rules knowing this constraint and revise any security models that rely solely on XPath constraints on System.User specializations to enforce restrictions at the App Security role-management configuration level instead.