System.User is a special Mendix platform entity used for user management. Unlike a normal application entity, it has built-in access behavior enforced by the runtime. That means its permissions are not controlled only by the inheritance model or by XPath filters on a specialization; the platform applies its own security rules first.
This matters because security assumptions can fail if developers treat System.User like ordinary data. In a vulnerable or misconfigured app, records tied to user objects may become more reachable than intended, including through broad roles such as anonymous access. Attackers look for these mistakes to read sensitive user data or escalate privileges, while defenders review App Security role settings, specializations, and access paths to make sure the runtime behavior matches the intended design.