The vulnerability arises when an Event Publisher output adapter is configured with properties that do not influence its operation; these superfluous settings are still recorded in the \"wso2carbon\" log. If the unintended property holds confidential or credential data, the log becomes a source of sensitive information that can be read by anyone with access to the log files. This leads to a pure information disclosure scenario in which attackers can obtain usernames, passwords, or other secrets without altering the underlying data flow or application logic.

WSO2 API Control Plane, WSO2 API Manager, WSO2 Carbon Event Publisher Core, WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 Open Banking AM, WSO2 Open Banking IAM, WSO2 Traffic Manager, and WSO2 Universal Gateway. The CVE ID does not list specific version constraints, so all current releases of these products could be impacted unless the affected behaviour has been removed by an update.

The CVSS base score of 4.4 places the flaw in the moderate range; however, the EPSS score is currently unavailable, and the issue is not listed in the CISA KEV catalog. The likely attack vector is local or compromised access to the \"wso2carbon\" log files. An attacker who can read these logs can retrieve any sensitive data that has been logged, enabling credential theft or further exploitation. No active remote exploitation is described, but if log files are exposed via an insecure web interface or other shared storage, the vulnerability could be leveraged remotely by an attacker with network access to the system.