The vulnerability CVE-2026-7891 arises from an authorization misconfiguration in VerySecureApp built with Mendix Studio Pro 11.8.0 Beta. Specifically, anonymous users with the anonymous user role in the MyFirstModule gain unintended access to all stored records. This is due to Mendix Studio Pro silently enforcing user inheritance rules on the anonymous user role, which is not documented. The issue requires that a Mendix Entity be made publicly available, enabling anonymous users to bypass intended access restrictions. This vulnerability is classified under CWE-277 (Insecure Inherited Permissions) and has a CVSS 4.0 score of 9.3, indicating critical severity.

The impact is high as anonymous, unauthenticated users can access all stored records in the affected module, leading to unintended data exposure. This compromises confidentiality of potentially sensitive data stored within the VerySecureApp. There is no indication of privilege escalation or data modification, but full read access to all records by anonymous users represents a serious security breach.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, avoid making Mendix Entities publicly accessible to anonymous users or restrict the use of the anonymous user role in the MyFirstModule. Review and adjust authorization configurations to explicitly deny access to anonymous users where appropriate. Monitor vendor communications for updates on official remediation.