Executive brief
WSO2's Class Mediator component, used within API Manager, Enterprise Integrator, and Micro Integrator products, fails to properly isolate data between separate system invocations. Authenticated users can exploit this to view sensitive business data intended for other users or to unintentionally modify request data, though user credentials and access tokens remain protected.
Technical details
The Class Mediator component in WSO2 products fails to properly validate and sanitize `messageContext` properties used for dynamic value substitution in string operations. The vulnerability requires an authenticated user and relies on specific configuration patterns (using `messageContext` for dynamic values, which the documentation discourages). An attacker can exploit this to access data from other invocations or modify request data unintentionally; however, this does not extend to user credentials or access tokens. Patches are available via GitHub pull request #2207 in wso2-synapse, and support subscription holders can apply targeted updates for their respective product versions.
Affected products
- WSO2 API Manager 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0
- WSO2 Enterprise Integrator 6.6.0
- WSO2 Micro Integrator 1.2.0, 4.1.0, 4.3.0
Timeline
- 2026-05-03: disclosed
- 2026-08-06: other: NVD entry published
- other: Public fix available at https://github.com/wso2/wso2-synapse/pull/2207