CVE-2024-6541: Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-06 · updated 2026-10-27
Weakness: CWE-20

Description

The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.

Affected products

WSO2 API Manager: from 3.2.0 before 3.2.0.394; from 3.2.1 before 3.2.1.21; from 4.0.0 before 4.0.0.311; from 4.1.0 before 4.1.0.167; from 4.2.0 before 4.2.0.110; from 4.3.0 before 4.3.0.24 — fixed in 3.2.0.394, 3.2.1.21, 4.0.0.311, 4.1.0.167, 4.2.0.110, 4.3.0.24
WSO2 Enterprise Integrator: from 6.6.0 before 6.6.0.205 — fixed in 6.6.0.205
WSO2-Synapse: from 2.1.7.wso2v182 before 2.1.7.wso2v182_93; from 2.1.7.wso2v143 before 2.1.7.wso2v143_119; from 2.1.7.wso2v183 before 2.1.7.wso2v183_62; from 2.1.7.wso2v319 before 2.1.7.wso2v319_7; from 2.1.7.wso2v227 before 2.1.7.wso2v227_88; from 2.1.7.wso2v271 before 2.1.7.wso2v271_60 — fixed in 2.1.7.wso2v143_119, 2.1.7.wso2v182_93, 2.1.7.wso2v183_62, 2.1.7.wso2v227_88, 2.1.7.wso2v271_60, 2.1.7.wso2v319_7
WSO2 Micro Integrator: from 1.2.0 before 1.2.0.163; from 4.1.0 before 4.1.0.103; from 4.3.0 before 4.3.0.7 — fixed in 1.2.0.163, 4.1.0.103, 4.3.0.7

How to fix

Upgrade to a fixed version: WSO2 API Manager 3.2.0.394, 3.2.1.21, 4.0.0.311, 4.1.0.167; WSO2 Enterprise Integrator 6.6.0.205; WSO2-Synapse 2.1.7.wso2v143_119, 2.1.7.wso2v182_93, 2.1.7.wso2v183_62, 2.1.7.wso2v227_88; WSO2 Micro Integrator 1.2.0.163, 4.1.0.103, 4.3.0.7. Check the vendor advisory for mitigations.

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/

Get alerted when CVE-2024-6541 or the next vulnerability affects your stack