Medium severity · published Aug 6, 2026
CVE-2024-6541
Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.
This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WSO2 API Manager · WSO2
3.2.0 before 3.2.0.394; 3.2.1 before 3.2.1.21; 4.0.0 before 4.0.0.311; 4.1.0 before 4.1.0.167; 4.2.0 before 4.2.0.110; 4.3.0 before 4.3.0.24 · source: vendor
WE
WSO2 Enterprise Integrator · WSO2
6.6.0 before 6.6.0.205 · source: vendor
WM
WSO2 Micro Integrator · WSO2
1.2.0 before 1.2.0.163; 4.1.0 before 4.1.0.103; 4.3.0 before 4.3.0.7 · source: vendor
WS
WSO2-Synapse · WSO2
2.1.7.wso2v182 before 2.1.7.wso2v182_93; 2.1.7.wso2v143 before 2.1.7.wso2v143_119; 2.1.7.wso2v183 before 2.1.7.wso2v183_62; 2.1.7.wso2v319 before 2.1.7.wso2v319_7; 2.1.7.wso2v227 before 2.1.7.wso2v227_88; 2.1.7.wso2v271 before 2.1.7.wso2v271_60; +3 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6541
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6541
security.docs.wso2.com
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/
More from WSO2 API Manager
10.0
CVE-2026-5430
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
10.0
CVE-2026-2053
Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager
9.8
CVE-2026-1728
Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
9.8
CVE-2025-9312
Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
9.8
CVE-2025-9152
Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint