The vulnerability identified as CVE-2025-12317 (CWE-613) affects WSO2 Enterprise Integrator version 6.6.0. When internal roles are removed from a user, the system fails to invalidate any previously issued authentication tokens for that user. Consequently, the user can continue to use these tokens to access resources or perform actions that should have been revoked. The CVSS 3.1 score is 5.0 (medium), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level. No official patch or remediation level has been published by the vendor as of the data provided.

Users whose roles have been revoked may continue to access resources and perform actions associated with their previous roles until their authentication tokens expire naturally. This can lead to unauthorized access and potential misuse of privileges within the affected WSO2 Enterprise Integrator environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider manual token invalidation or session management controls where possible to limit the risk of continued access by users with revoked roles.