Improper Access Control Vulnerability in Mendix Email Connector Module

An attacker with valid credentials could read and modify email configuration and sensitive data within applications using the Mendix Email Connector, potentially gaining access to email credentials or altering email routing and notifications critical to operations.

Organizations using Mendix Email Connector in applications that handle sensitive email configurations, alerts, or notifications—including utility SCADA systems, historian interfaces, and operational reporting platforms that rely on email for notifications to control room operators.

An attacker with valid credentials to the Mendix application accesses the Email Connector module entities and exploits improper access controls to read sensitive configuration data (such as email credentials) or manipulate email settings without authorization.