This vulnerability (CVE-2025-40571) concerns incorrect privilege assignment (CWE-266) in Siemens Mendix OIDC SSO modules for Mendix 9 and 10 compatible versions. Specifically, all tokens are accessible for read and write operations only by the Administrator role. This could lead to privilege misuse if an adversary with administrative access modifies the module during development. The affected versions include all versions prior to V4.0.1 for Mendix 10.12 compatible, prior to V3.3.1 for Mendix 9 compatible, prior to V4.2.1 for Mendix 10 compatible V4.2, and all versions of Mendix 10 compatible V4.3. The CVSS v3.1 base score is 2.2, indicating low severity, with network attack vector, high attack complexity, and requiring high privileges. No known exploits or patches are currently documented in the provided data.

The impact is limited to potential privilege misuse by an adversary who already has administrative privileges within the Mendix development environment. The vulnerability does not allow privilege escalation or impact confidentiality, integrity, or availability beyond the scope of administrator-level access. There are no reported active exploits. The low CVSS score reflects the limited impact and high complexity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links are provided, users should monitor Siemens Mendix advisories for updates. Until a fix is available, restrict administrative access to trusted personnel only and review administrative actions within the Mendix development environment to detect potential misuse. No vendor advisory content indicating 'no action required' or 'already mitigated' is provided.