Low severity2.7NVD Advisory· Published Oct 19, 2026

CVE-2024-4412

Description

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.

Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

Affected products

Wso2 Extensions/Identity Governancereferences

Patches

Vulnerability mechanics

References

github.com/wso2-extensions/identity-governance/pull/848nvd
github.com/wso2/carbon-identity-framework/pull/5895nvd
github.com/wso2/identity-apps/pull/6829nvd
github.com/wso2/product-apim/pull/13524nvd
security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/nvd

News mentions

No linked articles in our index yet.

cvss	0.176
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000