CVE-2026-4103
Received Received - Intake

Stored XSS in API Documentation Portals

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: WSO2 LLC

Description
Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may result in the execution of malicious scripts within the user's browser context when viewing API documentation. Users with permissions to access the API documentation through these portals may be impacted, potentially allowing attackers to perform actions on behalf of the user, depending on their session privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-4103
EUVD
EUVD-2026-77586

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
wso2 api_control_plane 4.6.0
wso2 api_control_plane 4.5.0
wso2 api_manager From 3.2.0 (inc) to 4.6.0 (inc)
wso2 api_manager 4.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability caused by insufficient HTML sanitization in WSO2 API Control Plane and API Manager. Untrusted user input in API documentation is not properly encoded, allowing malicious JavaScript injection. When viewed, this script executes in the user's browser context.

Detection Guidance

To detect this vulnerability, inspect the WSO2 API Control Plane and API Manager versions for affected releases (4.6.0, 4.5.0, or 3.2.0 to 4.6.0). Check if the 'sanitizeHtmlDocs' configuration is enabled in the Publisher Portal and Developer Portal settings files. Review API documentation content for suspicious JavaScript code or untrusted input rendering.

Impact Analysis

Attackers could execute malicious scripts within your browser session when viewing API documentation. This may allow them to perform actions on your behalf depending on your session privileges, such as accessing or modifying data you can view.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized script execution in user sessions. Attackers could steal session tokens or sensitive data, violating confidentiality requirements under these regulations. The stored XSS may lead to unauthorized access or data exfiltration, which are key compliance concerns for both standards.

Mitigation Strategies

Apply the fixes provided in the public pull request or update to the specified versions. For versions 4.2.0 and above, enable the 'sanitizeHtmlDocs' configuration in both portals' settings files. Older versions require similar sanitization configurations in their settings files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4103. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart