The vulnerability permits the injection of Expression Language code through user-supplied data that is insufficiently validated. This allows an attacker with administrative privileges to execute arbitrary operations inside the affected deployment, though the scope of EL usage is restricted to certain read operations, so the impact is minimized.

Affected vendors include WSO2 products such as WSO2 API Manager, WSO2 Carbon Identity Application Authentication Framework, WSO2 Carbon Identity Recovery Management, WSO2 Carbon Identity User Store, WSO2 Carbon Identity User Store Configuration, WSO2 Carbon Identity User Store Configuration UI, WSO2 Enterprise Integrator, WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM. Specific version information was not provided in the source data, so the impact applies to any installation of these products that have not applied the vendor's fix.

The CVSS score of 2.7 indicates a low severity, and the EPSS score is not available, suggesting that the vulnerability is not widely exploited. It is not listed in the CISA KEV catalog. Exploitation requires administrator-level access, which limits the likelihood that an unauthenticated attacker could exploit the flaw. The overall risk is therefore low, but any environment that allows user input to reach EL evaluation endpoints should treat the issue as a potential lower‑end code execution risk until the patch is applied.