Critical severity9.8NVD Advisory· Published Mar 8, 2022· Updated Jun 17, 2026

CVE-2022-26313

Description

A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts.

Affected products

Mendix/Forgot Password
cpe:2.3:a:mendix:forgot_password:*:*:*:*:*:*:*:*
Range: >=3.3.0,<3.5.1
Mendix/Forgot Password Appstore modulellm-create
Range: >=V3.3.0 <V3.5.1
Siemens Foundation/Mendix Forgot Password Appstore modulellm-create
Range: >=V3.3.0 <V3.5.1
Siemens Foundation/Mendix Forgot Passwordcpe-rescue
Range: All versions >= V3.3.0 < V3.5.1

Patches

Vulnerability mechanics

References

cert-portal.siemens.com/productcert/pdf/ssa-134279.pdfnvdMitigationPatchVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000