The vulnerability in VerySecureApp, built with Mendix Studio Pro 11.8.0 Beta, stems from an authorization misconfiguration that permits anonymous users of MyFirstModule to retrieve all stored records. No explicit access rights are set for the anonymous role, yet the application silently applies user inheritance rules, effectively granting unauthorized read privileges. This flaw directly leads to confidential data being exposed without the need for authentication.

The affected product is VerySecureApp, released by DIVD. All iterations of the Mendix Studio Pro up to and including the 11.8.0 Beta version are impacted because they automatically cause an anonymous user role to inherit permissions that were not documented. Anonymous users can exploit this in the MyFirstModule component of the application.

The CVSS score of 9.3 indicates a very high severity vulnerability. The EPSS score is not available, so the exact exploitation probability is unknown, but the lack of controls suggests a high likelihood of exploitation if exposed. The vulnerability is not currently listed in the CISA KEV catalog. Likely the attack vector is a web request from an unauthenticated client to the MyFirstModule endpoints, from which the attacker can retrieve any records stored in the application.