Threats affecting pkg:maven/com.siemens/mendix-studio-pro

CVE-2026-112137 is a Cross-Site Request Forgery (CSRF) vulnerability in Siemens Mendix Studio Pro 11 MCP Server. It affects versions 11.15.0 up to but not including 11.16.0 and 11.12.6 up to but not including 11.12.7. The vulnerability arises because the MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests. This flaw could allow a malicious web page to trick a user's browser into sending unauthorized requests that execute unintended actions on the local MCP Server. The issue has been fixed in versions 11.16.0 and 11.12.7. The CVSS v3.1 base score is 5.4, indicating a medium severity level.