This vulnerability (CVE-2026-11561) in Apinizer arises from improper neutralization of special elements in expression language statements, classified as CWE-917. This flaw can lead to expression language injection, enabling code injection attacks. The affected version is exactly 2026.04.0. The CVSS v3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality but not integrity or availability. No vendor advisory or patch information is available, and the product is not a cloud service.

The vulnerability allows an attacker to perform code injection via expression language injection, potentially leading to unauthorized disclosure of information (confidentiality impact). There is no reported impact on integrity or availability. Exploitation does not require privileges or user interaction and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to vulnerable Apinizer instances and applying any recommended configuration hardening specific to expression language usage if available.