CVE-2026-4103

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may result in the execution of malicious scripts within the user's browser context when viewing API documentation. Users with permissions to access the API documentation through these portals may be impacted, potentially allowing attackers to perform actions on behalf of the user, depending on their session privileges.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.1 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-4844/

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-14 16:17

Updated : 2026-09-14 20:16

NVD link : CVE-2026-4103

Mitre link : CVE-2026-4103

CVE.ORG link : CVE-2026-4103

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-4103", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4103", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-14T19:12:26.565275Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 API Control Plane", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.55", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.19", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.2.0", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.470", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.89", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.254", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.194", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.105", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.0.69", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.54", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.18", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-14T16:17:11.710", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-4844/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed.\n\nSuccessful exploitation may result in the execution of malicious scripts within the user's browser context when viewing API documentation. Users with permissions to access the API documentation through these portals may be impacted, potentially allowing attackers to perform actions on behalf of the user, depending on their session privileges."}], "lastModified": "2026-09-14T20:16:44.490", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}