The vulnerability arises from improper input validation (CWE-20) in the Class Mediator component of WSO2 Micro Integrator. Specifically, messageContext properties are not correctly validated or sanitized when used to populate dynamic values, enabling authenticated users to access or modify data across system invocations that should be isolated. This can lead to unauthorized disclosure or modification of sensitive data. The affected versions explicitly identified are 1.2.0, 4.1.0, and 4.3.0. The CVSS v3.1 base score is 6.8, indicating medium severity, with network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. No vendor advisory or patch information is provided, and no known exploits in the wild have been reported.

Authenticated users can exploit this vulnerability to access or modify data across different system invocations that should be isolated, potentially leading to disclosure of sensitive information or unintended modification of system data. The exact impact depends on the usage context of messageContext properties within the affected WSO2 Micro Integrator versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a patch is available, restrict access to authenticated users and review usage of messageContext properties to minimize risk.