CVE-2026-4103

Summary

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed.

Successful exploitation may result in the execution of malicious scripts within the user's browser context when viewing API documentation. Users with permissions to access the API documentation through these portals may be impacted, potentially allowing attackers to perform actions on behalf of the user, depending on their session privileges.

Affected Software

VendorProductVersion RangeStatus
WSO2WSO2 API Control Plane4.5.0 < 4.5.0.55affected
WSO2WSO2 API Control Plane4.6.0 < 4.6.0.19affected
WSO2WSO2 API Manager0 < 3.2.0unknown
WSO2WSO2 API Manager3.2.0 < 3.2.0.470affected
WSO2WSO2 API Manager3.2.1 < 3.2.1.89affected
WSO2WSO2 API Manager4.1.0 < 4.1.0.254affected
WSO2WSO2 API Manager4.2.0 < 4.2.0.194affected
WSO2WSO2 API Manager4.3.0 < 4.3.0.105affected
WSO2WSO2 API Manager4.4.0 < 4.4.0.69affected
WSO2WSO2 API Manager4.5.0 < 4.5.0.54affected
WSO2WSO2 API Manager4.6.0 < 4.6.0.18affected

Weaknesses

  • CWE-79: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References