--- title: TSU-02 Insecure Entity Access in Mendix | Omnext description: Entity access rules and XPath constraints decide who reads what in Mendix. The misconfigurations that leak data, and how to find them automatically. image: https://www.omnext.com/hubfs/raw_assets/public/Cerios%20Solutions%20Theme%20-%20Omnext/omx-sept-2026/images/omx-og-default.png --- [![Omnext](https://www.omnext.com/hubfs/Omnext/Omnext%20-%20Logo%20+%20Slogan.svg)](https://www.omnext.com?hsLang=en) [Platform](https://www.omnext.com/mendix-quality-analysis?hsLang=en) [Mendix quality analysisMaintainability, architecture and technical debt, scored every sprint.](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Mendix security analysisThe S-Unit Top 10, checked automatically on every build.](https://www.omnext.com/mendix-security-analysis?hsLang=en)[DevAssist for Studio ProFindings in the IDE, while the developer is still in the model.](https://www.omnext.com/devassist?hsLang=en)[Omnext MCPAll analysis data, ready for your AI agents and assistants.](https://www.omnext.com/omnext-mcp?hsLang=en) [Pricing](https://www.omnext.com/pricing?hsLang=en) [Resources](https://www.omnext.com/resources?hsLang=en) [Knowledge baseThe full product documentation, for everyone who works with Omnext.](https://help.omnext.com/?hsLang=en)[Fact sheetsQuality and security analysis for Mendix, in two short PDFs.](https://www.omnext.com/fact-sheet-request?hsLang=en)[Mendix security self-assessmentTen questions, five minutes, your security profile on screen.](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[CoE Maturity ScanWhere your Center of Excellence stands today.](https://www.omnext.com/en/coe-maturity-scan?hsLang=en)[NIS2 readiness checklistTwenty-four items, your readiness score on screen.](https://www.omnext.com/nis2-readiness-checklist-mendix?hsLang=en)[The S-Unit Top 10Ten Mendix-specific security categories, explained.](https://www.omnext.com/s-unit-top-10?hsLang=en)[BlogArticles on Mendix quality, security and governance.](https://www.omnext.com/blog?hsLang=en)[Trust CenterHosting, data handling and certifications.](https://www.omnext.com/trust-center?hsLang=en)[All resourcesEverything in one overview.](https://www.omnext.com/resources?hsLang=en) [Partners](https://www.omnext.com/partners?hsLang=en)[Contact](https://www.omnext.com/contact?hsLang=en) Search [Log in](https://portal.omnext.net/)[Request a demo](https://www.omnext.com/demo?hsLang=en) Menu [Platform](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Mendix quality analysis](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Mendix security analysis](https://www.omnext.com/mendix-security-analysis?hsLang=en)[DevAssist for Studio Pro](https://www.omnext.com/devassist?hsLang=en)[Omnext MCP](https://www.omnext.com/omnext-mcp?hsLang=en)[Pricing](https://www.omnext.com/pricing?hsLang=en)[Resources](https://www.omnext.com/resources?hsLang=en)[Knowledge base](https://help.omnext.com/?hsLang=en)[Fact sheets](https://www.omnext.com/fact-sheet-request?hsLang=en)[Mendix security self-assessment](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[CoE Maturity Scan](https://www.omnext.com/en/coe-maturity-scan?hsLang=en)[NIS2 readiness checklist](https://www.omnext.com/nis2-readiness-checklist-mendix?hsLang=en)[The S-Unit Top 10](https://www.omnext.com/s-unit-top-10?hsLang=en)[Blog](https://www.omnext.com/blog?hsLang=en)[Trust Center](https://www.omnext.com/trust-center?hsLang=en)[All resources](https://www.omnext.com/resources?hsLang=en)[Partners](https://www.omnext.com/partners?hsLang=en)[Contact](https://www.omnext.com/contact?hsLang=en) [Request a demo](https://www.omnext.com/demo?hsLang=en)[Log in](https://portal.omnext.net/) S-Unit Top 10 · TSU-02 # Insecure entity access Entity access is where the role model meets the data. A rule that is one column too wide, or an XPath constraint that was never added, turns a carefully designed security model into a database anyone can read. This is the category we find most often, and the one with the largest blast radius. [Take the free security self-check](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[All ten categories](https://www.omnext.com/s-unit-top-10?hsLang=en) Where it goes wrong ## How this shows up in a Mendix application. ### Missing XPath constraints Read or write access on a persistent entity with no constraint at all, so the rule covers every record instead of the user's own. ### Write access on the constraint itself If a user can write the attribute their own XPath constraint filters on, they can point the constraint at somebody else's data. ### Write access on security attributes Attributes that microflow logic checks, such as a status or an approval flag, are writable directly and the check becomes decoration. ### Create and delete without a microflow Direct create or delete rights skip the validation and authorisation that the microflow would have performed. ### Create access on audit entities Rights on log or audit entities let someone fabricate or destroy the record of what happened. ### Associations left open The entity is protected but the association pointing at it is not, so the data is reachable one hop away. Impact ## What it lets someone do. Every item below has been found in production applications. None of them requires a sophisticated attacker: they require somebody who reads the page source, edits a request or simply logs in. Read financial, medical or contractual records belonging to other users Change a status or approval attribute and escalate their own privileges Commit data that never passed validation Remove the audit trail that would have shown what they did Prevention ## How to keep it out. ### One rule, one module role Keep access rules specific per role rather than shared, so least privilege is visible in the model instead of implied. ### Constrain user, group and status data XPath constraints on user-specific data, on group or project data, and on status-dependent records such as draft against published. ### Write through microflows Replace direct write and delete with microflows that authorise and validate first, and keep constraint attributes out of reach. Automated ## What Omnext checks for you. Omnext builds the full CRUDE matrix, every user role against every entity, and flags access rules without an XPath constraint, constraints on attributes or associations the user can write, write access on associations, conflicting rules, anonymous access and read access on hashed strings. [See the security analysis](https://www.omnext.com/mendix-security-analysis?hsLang=en) Source ## The framework is The S-Unit's. The S-Unit Top 10 is the work of The S-Unit, the Mendix security specialists. They built it from more than ten years of offensive security work and hundreds of Mendix penetration tests, and they maintain the canonical version. Omnext automates the checks in the Security Analysis module; the framework itself is theirs, and this page explains it in our own words. [Read the original on the-s-unit.nl](https://the-s-unit.nl/en/tsu-02-insecure-entity-access-configuration/) Keep reading ## The rest of the S-Unit Top 10. Ten categories in total. [See the full list](https://www.omnext.com/s-unit-top-10?hsLang=en). [TSU-01Insecure user roles](https://www.omnext.com/tsu-01-insecure-user-roles?hsLang=en) [TSU-03Insecure microflows](https://www.omnext.com/tsu-03-insecure-microflows?hsLang=en) Next step ## Which of the ten are you sure about? Ten questions, about five minutes, results on screen. Or let the scan answer all ten with evidence from your own model. [Take the self-check](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[Request a demo](https://www.omnext.com/demo?hsLang=en) ![Omnext](https://www.omnext.com/hubfs/Omnext/Omnext%20-%20Logo%20-%20Inverted.svg) Automated quality and security analysis for Mendix. Build Fast. Stay in Control. ISO 27001:2023GDPRHosted on Azure (EU) Platform[Quality Analysis for Mendix](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Security Analysis (SAST)](https://www.omnext.com/mendix-security-analysis?hsLang=en)[DevAssist for Studio Pro](https://www.omnext.com/devassist?hsLang=en)[Omnext MCP](https://www.omnext.com/omnext-mcp?hsLang=en)[Pricing](https://www.omnext.com/pricing?hsLang=en) Resources[Fact sheets](https://www.omnext.com/fact-sheet-request?hsLang=en)[Security Self-Assessment](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[CoE Maturity Scan](https://www.omnext.com/en/coe-maturity-scan?hsLang=en)[Blog](https://www.omnext.com/blog?hsLang=en)[Knowledge base](https://help.omnext.com/?hsLang=en)[All resources](https://www.omnext.com/resources?hsLang=en) Company[Partners](https://www.omnext.com/partners?hsLang=en)[Trust Center](https://www.omnext.com/trust-center?hsLang=en)[Contact](https://www.omnext.com/contact?hsLang=en)[Request a demo](https://www.omnext.com/demo?hsLang=en) ContactCerios | Omnext B.V. Orteliuslaan 1000 3528 BD Utrecht, The Netherlands[contact@omnext.com](mailto:contact@omnext.com)[LinkedIn](https://www.linkedin.com/company/omnext/) © 2026 Cerios | Omnext B.V. · part of Cerios Solutions · KvK 09115372[Privacy policy](https://www.omnext.com/privacy-policy?hsLang=en)[Security & disclosure](https://www.omnext.com/trust-center?hsLang=en)