# CVE-2024-6541: WSO2 Class Mediator improper messageContext validation

Source: https://junglewise.ai/threats/cve-2024-6541-wso2-class-mediator-improper-messagecontext-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-6541 · Severity: medium · CVSS 6.8 · Published 2026-08-06

WSO2's Class Mediator component, used within API Manager, Enterprise Integrator, and Micro Integrator products, fails to properly isolate data between separate system invocations. Authenticated users can exploit this to view sensitive business data intended for other users or to unintentionally modify request data, though user credentials and access tokens remain protected.

Technologies: [Wso2 API Manager](https://junglewise.ai/threats/technologies/api-manager), [Wso2 Enterprise Integrator](https://junglewise.ai/threats/technologies/enterprise-integrator). Vendors: [Wso2](https://junglewise.ai/threats/vendors/wso2).

## Quick answers

**Is CVE-2024-6541 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-6541 being exploited in the wild.

**How severe is CVE-2024-6541?** Medium severity, with a CVSS score of 6.8, published 6 August 2026.

**Which products and versions are affected?** Wso2 API Manager 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0; Wso2 Enterprise Integrator 6.6.0; Wso2 Micro Integrator 1.2.0, 4.1.0, 4.3.0.

**Is there a fix for CVE-2024-6541?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-6541 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-6541?** Check whether you run Wso2 API Manager, Wso2 Enterprise Integrator or Wso2 Micro Integrator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Class Mediator component in WSO2 products fails to properly validate and sanitize `messageContext` properties used for dynamic value substitution in string operations. The vulnerability requires an authenticated user and relies on specific configuration patterns (using `messageContext` for dynamic values, which the documentation discourages). An attacker can exploit this to access data from other invocations or modify request data unintentionally; however, this does not extend to user credentials or access tokens. Patches are available via GitHub pull request #2207 in wso2-synapse, and support subscription holders can apply targeted updates for their respective product versions.

## Affected products

- WSO2 API Manager 3.2.0, 3.2.1, 4.0.0, 4.1.0, 4.2.0, 4.3.0
- WSO2 Enterprise Integrator 6.6.0
- WSO2 Micro Integrator 1.2.0, 4.1.0, 4.3.0

## Timeline

- 2026-05-03: disclosed
- 2026-08-06: other: NVD entry published
- other: Public fix available at https://github.com/wso2/wso2-synapse/pull/2207

## References

- [https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/)

## Related threats

- [WSO2 Identity Server privilege escalation via shared database](https://junglewise.ai/threats/cve-2026-4052-this-issue-only-impacts-deployments-where-wso2-identity-server-is)
- [WSO2 API Manager Admin REST API SQL injection](https://junglewise.ai/threats/cve-2026-2613-the-admin-rest-api-accepts-user-supplied-input-without-adequately)
- [WSO2 API Manager SVG upload stored XSS in Publisher portal](https://junglewise.ai/threats/cve-2025-12544-the-publisher-portal-fails-to-enforce-proper-validation-on)
- [WSO2 products sensitive information disclosure in Event Publisher logs](https://junglewise.ai/threats/cve-2026-18800-when-an-event-publisher-output-adapter-is-configured-with)
- [WSO2 System REST APIs access control bypass](https://junglewise.ai/threats/cve-2025-11969-the-system-rest-apis-do-not-correctly-enforce-access-control)