--- title: TSU-04 Insecure Published Integrations in Mendix | Omnext description: Published REST, OData and SOAP services expose microflows and entities. The settings that go wrong in Mendix, and how to check every endpoint automatically. image: https://www.omnext.com/hubfs/raw_assets/public/Cerios%20Solutions%20Theme%20-%20Omnext/omx-sept-2026/images/omx-og-default.png --- [![Omnext](https://www.omnext.com/hubfs/Omnext/Omnext%20-%20Logo%20+%20Slogan.svg)](https://www.omnext.com?hsLang=en) [Platform](https://www.omnext.com/mendix-quality-analysis?hsLang=en) [Mendix quality analysisMaintainability, architecture and technical debt, scored every sprint.](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Mendix security analysisThe S-Unit Top 10, checked automatically on every build.](https://www.omnext.com/mendix-security-analysis?hsLang=en)[DevAssist for Studio ProFindings in the IDE, while the developer is still in the model.](https://www.omnext.com/devassist?hsLang=en)[Omnext MCPAll analysis data, ready for your AI agents and assistants.](https://www.omnext.com/omnext-mcp?hsLang=en) [Pricing](https://www.omnext.com/pricing?hsLang=en) [Resources](https://www.omnext.com/resources?hsLang=en) [Knowledge baseThe full product documentation, for everyone who works with Omnext.](https://help.omnext.com/?hsLang=en)[Fact sheetsQuality and security analysis for Mendix, in two short PDFs.](https://www.omnext.com/fact-sheet-request?hsLang=en)[Mendix security self-assessmentTen questions, five minutes, your security profile on screen.](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[CoE Maturity ScanWhere your Center of Excellence stands today.](https://www.omnext.com/en/coe-maturity-scan?hsLang=en)[NIS2 readiness checklistTwenty-four items, your readiness score on screen.](https://www.omnext.com/nis2-readiness-checklist-mendix?hsLang=en)[The S-Unit Top 10Ten Mendix-specific security categories, explained.](https://www.omnext.com/s-unit-top-10?hsLang=en)[BlogArticles on Mendix quality, security and governance.](https://www.omnext.com/blog?hsLang=en)[Trust CenterHosting, data handling and certifications.](https://www.omnext.com/trust-center?hsLang=en)[All resourcesEverything in one overview.](https://www.omnext.com/resources?hsLang=en) [Partners](https://www.omnext.com/partners?hsLang=en)[Contact](https://www.omnext.com/contact?hsLang=en) Search [Log in](https://portal.omnext.net/)[Request a demo](https://www.omnext.com/demo?hsLang=en) Menu [Platform](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Mendix quality analysis](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Mendix security analysis](https://www.omnext.com/mendix-security-analysis?hsLang=en)[DevAssist for Studio Pro](https://www.omnext.com/devassist?hsLang=en)[Omnext MCP](https://www.omnext.com/omnext-mcp?hsLang=en)[Pricing](https://www.omnext.com/pricing?hsLang=en)[Resources](https://www.omnext.com/resources?hsLang=en)[Knowledge base](https://help.omnext.com/?hsLang=en)[Fact sheets](https://www.omnext.com/fact-sheet-request?hsLang=en)[Mendix security self-assessment](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[CoE Maturity Scan](https://www.omnext.com/en/coe-maturity-scan?hsLang=en)[NIS2 readiness checklist](https://www.omnext.com/nis2-readiness-checklist-mendix?hsLang=en)[The S-Unit Top 10](https://www.omnext.com/s-unit-top-10?hsLang=en)[Blog](https://www.omnext.com/blog?hsLang=en)[Trust Center](https://www.omnext.com/trust-center?hsLang=en)[All resources](https://www.omnext.com/resources?hsLang=en)[Partners](https://www.omnext.com/partners?hsLang=en)[Contact](https://www.omnext.com/contact?hsLang=en) [Request a demo](https://www.omnext.com/demo?hsLang=en)[Log in](https://portal.omnext.net/) S-Unit Top 10 · TSU-04 # Insecure published integrations A published REST, OData or SOAP service puts your microflows and entities on the network. It is the one part of the application that faces outward by design, it skips everything the user interface implicitly protected, and it is regularly the weakest point of an otherwise well-built app. [Take the free security self-check](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[All ten categories](https://www.omnext.com/s-unit-top-10?hsLang=en) Where it goes wrong ## How this shows up in a Mendix application. ### No authentication on sensitive data The endpoint is open because it was easier during development, and the data behind it is not public. ### End-user roles on system integrations The service is granted to module roles that ordinary users also hold, so anyone who can log in can call the API. ### Hand-built authentication A custom login microflow in place of the platform mechanism, usually without the custom authentication setting that would make it enforceable. ### Every role on every operation Access is granted at the service level and never narrowed per operation, so one endpoint opens all of them. ### Import mappings straight into persistent data Incoming payloads are mapped directly onto persistent entities, without validation and before anything has been checked. ### Direct object references in the mapping Identifiers in the payload point at objects by key, so changing a number in the request reaches somebody else's record. Impact ## What it lets someone do. Every item below has been found in production applications. None of them requires a sophisticated attacker: they require somebody who reads the page source, edits a request or simply logs in. Pull confidential data straight from an endpoint Call system-to-system operations with an ordinary user account Defeat a weak custom authentication microflow Reach other people's objects by editing an identifier in the payload Prevention ## How to keep it out. ### Built-in authentication, dedicated accounts Mendix password authentication with long random credentials or SSO, on integration accounts with their own roles, not on end-user roles. ### Restrict at both levels Allowed roles on the service and roles per operation, so an open endpoint cannot be used as a door to the rest. ### Map to non-persistent first Land incoming data in non-persistent entities, validate it there, and only then write anything that persists. Automated ## What Omnext checks for you. Omnext lists every published service with its authentication setting, the roles allowed on the service and per operation, and the import mappings that write into persistent entities. [See the security analysis](https://www.omnext.com/mendix-security-analysis?hsLang=en) Source ## The framework is The S-Unit's. The S-Unit Top 10 is the work of The S-Unit, the Mendix security specialists. They built it from more than ten years of offensive security work and hundreds of Mendix penetration tests, and they maintain the canonical version. Omnext automates the checks in the Security Analysis module; the framework itself is theirs, and this page explains it in our own words. [Read the original on the-s-unit.nl](https://the-s-unit.nl/en/tsu-04-insecure-published-integrations/) Keep reading ## The rest of the S-Unit Top 10. Ten categories in total. [See the full list](https://www.omnext.com/s-unit-top-10?hsLang=en). [TSU-03Insecure microflows](https://www.omnext.com/tsu-03-insecure-microflows?hsLang=en) [TSU-05Insecure consumption of integrations](https://www.omnext.com/tsu-05-insecure-consumption-of-integrations?hsLang=en) Next step ## Which of the ten are you sure about? Ten questions, about five minutes, results on screen. Or let the scan answer all ten with evidence from your own model. [Take the self-check](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[Request a demo](https://www.omnext.com/demo?hsLang=en) ![Omnext](https://www.omnext.com/hubfs/Omnext/Omnext%20-%20Logo%20-%20Inverted.svg) Automated quality and security analysis for Mendix. Build Fast. Stay in Control. ISO 27001:2023GDPRHosted on Azure (EU) Platform[Quality Analysis for Mendix](https://www.omnext.com/mendix-quality-analysis?hsLang=en)[Security Analysis (SAST)](https://www.omnext.com/mendix-security-analysis?hsLang=en)[DevAssist for Studio Pro](https://www.omnext.com/devassist?hsLang=en)[Omnext MCP](https://www.omnext.com/omnext-mcp?hsLang=en)[Pricing](https://www.omnext.com/pricing?hsLang=en) Resources[Fact sheets](https://www.omnext.com/fact-sheet-request?hsLang=en)[Security Self-Assessment](https://www.omnext.com/mendix-security-self-assessment?hsLang=en)[CoE Maturity Scan](https://www.omnext.com/en/coe-maturity-scan?hsLang=en)[Blog](https://www.omnext.com/blog?hsLang=en)[Knowledge base](https://help.omnext.com/?hsLang=en)[All resources](https://www.omnext.com/resources?hsLang=en) Company[Partners](https://www.omnext.com/partners?hsLang=en)[Trust Center](https://www.omnext.com/trust-center?hsLang=en)[Contact](https://www.omnext.com/contact?hsLang=en)[Request a demo](https://www.omnext.com/demo?hsLang=en) ContactCerios | Omnext B.V. Orteliuslaan 1000 3528 BD Utrecht, The Netherlands[contact@omnext.com](mailto:contact@omnext.com)[LinkedIn](https://www.linkedin.com/company/omnext/) © 2026 Cerios | Omnext B.V. · part of Cerios Solutions · KvK 09115372[Privacy policy](https://www.omnext.com/privacy-policy?hsLang=en)[Security & disclosure](https://www.omnext.com/trust-center?hsLang=en)