Insecure entity access
Entity access is where the role model meets the data. A rule that is one column too wide, or an XPath constraint that was never added, turns a carefully designed security model into a database anyone can read. This is the category we find most often, and the one with the largest blast radius.
How this shows up in a Mendix application.
Missing XPath constraints
Read or write access on a persistent entity with no constraint at all, so the rule covers every record instead of the user's own.
Write access on the constraint itself
If a user can write the attribute their own XPath constraint filters on, they can point the constraint at somebody else's data.
Write access on security attributes
Attributes that microflow logic checks, such as a status or an approval flag, are writable directly and the check becomes decoration.
Create and delete without a microflow
Direct create or delete rights skip the validation and authorisation that the microflow would have performed.
Create access on audit entities
Rights on log or audit entities let someone fabricate or destroy the record of what happened.
Associations left open
The entity is protected but the association pointing at it is not, so the data is reachable one hop away.
What it lets someone do.
Every item below has been found in production applications. None of them requires a sophisticated attacker: they require somebody who reads the page source, edits a request or simply logs in.
How to keep it out.
One rule, one module role
Keep access rules specific per role rather than shared, so least privilege is visible in the model instead of implied.
Constrain user, group and status data
XPath constraints on user-specific data, on group or project data, and on status-dependent records such as draft against published.
Write through microflows
Replace direct write and delete with microflows that authorise and validate first, and keep constraint attributes out of reach.
What Omnext checks for you.
Omnext builds the full CRUDE matrix, every user role against every entity, and flags unconstrained rules, writable constraint attributes and open associations to sensitive data.
The framework is The S-Unit's.
The S-Unit Top 10 is the work of The S-Unit, the Mendix security specialists. They built it from more than ten years of offensive security work and hundreds of Mendix penetration tests, and they maintain the canonical version. Omnext automates the checks in the Security Analysis module; the framework itself is theirs, and this page explains it in our own words.
Which of the ten are you sure about?
Ten questions, about four minutes, results on screen. Or let the scan answer all ten with evidence from your own model.