CVE-2026-4103: Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution
Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed.
Successful exploitation may result in the execution of malicious scripts within the user's browser context when viewing API documentation. Users with permissions to access the API documentation through these portals may be impacted, potentially allowing attackers to perform actions on behalf of the user, depending on their session privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who have permission to access API documentation in the affected Publisher Portal or Developer Portal may be exposed when they view a document containing malicious input. The impact depends on the privileges of the victim's active portal session.
What does an attacker need to exploit it?
An attacker needs the ability to supply untrusted content that is rendered in affected API documentation and must cause a permitted portal user to view that documentation. No user interaction beyond viewing the malicious document is described.
What could exploitation allow?
Malicious JavaScript can execute in the browser context of the user viewing the affected API documentation. This may allow actions to be performed on that user's behalf, subject to the user's session privileges.