{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role and could result in privilege misuse by an adversary modifying the module during Mendix development.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: \nhttps://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-726617: Incorrect Privilege Assignment Vulnerability in Mendix OIDC SSO Module - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-726617.html"
      },
      {
        "category": "self",
        "summary": "SSA-726617: Incorrect Privilege Assignment Vulnerability in Mendix OIDC SSO Module - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-726617.json"
      }
    ],
    "title": "SSA-726617: Incorrect Privilege Assignment Vulnerability in Mendix OIDC SSO Module",
    "tracking": {
      "current_release_date": "2025-06-12T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-726617",
      "initial_release_date": "2025-05-13T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-05-13T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2025-05-22T00:00:00Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Corrected remediation for Mendix OIDC SSO (Mendix 10 compatible)"
        },
        {
          "date": "2025-06-12T00:00:00Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Added fix for Mendix OIDC SSO (Mendix 10.12 compatible)"
        }
      ],
      "status": "interim",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Mendix OIDC SSO (Mendix 9 compatible)",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix OIDC SSO (Mendix 9 compatible)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV4.1.0",
                "product": {
                  "name": "Mendix OIDC SSO (Mendix 10 compatible)",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix OIDC SSO (Mendix 10 compatible)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV4.0.1",
                "product": {
                  "name": "Mendix OIDC SSO (Mendix 10.12 compatible)",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix OIDC SSO (Mendix 10.12 compatible)"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-40571",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role and could result in privilege misuse by an adversary modifying the module during Mendix development.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "The default configuration of the OIDC.Token entity is to restrict read/write access only to the administrator role. If this setting is not restrictive enough the option arises to change the access rule of the specific entity, or to create a different user role to handle different administrative tasks",
          "product_ids": [
            "1",
            "2",
            "3"
          ]
        },
        {
          "category": "none_available",
          "details": "Currently no fix is available",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.1 or later version",
          "product_ids": [
            "3"
          ],
          "url": "https://marketplace.mendix.com/link/component/120371"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V4.1.0 or later version",
          "product_ids": [
            "2"
          ],
          "url": "https://marketplace.mendix.com/link/component/120371"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3"
          ]
        }
      ],
      "title": "CVE-2025-40571"
    }
  ]
}