The vulnerability arises because when internal roles are removed from a user in WSO2 Enterprise Integrator 6.6.0, the system does not invalidate any previously issued authentication tokens associated with that user. Consequently, the user can continue to use these tokens to access resources or perform actions that should have been revoked. The CVSS 3.1 score is 5.0 (medium), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level.

Users whose roles have been revoked may still retain access privileges through previously issued authentication tokens until those tokens expire naturally. This can lead to unauthorized access and actions within the affected WSO2 Enterprise Integrator environment, potentially compromising confidentiality, integrity, and availability to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Organizations should monitor vendor communications for updates and consider limiting token lifetime or manually invalidating tokens if possible.