Security Advisory WSO2-2026-4844/CVE-2026-4103¶

Published: July 04, 2026

Updated: July 04, 2026

Version: 1.0

Severity: Medium

CVSS Score: 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVE IDs: CVE-2026-4103

AFFECTED PRODUCTS¶

• WSO2 API Control Plane: 4.6.0, 4.5.0
• WSO2 API Manager: 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, 4.1.0, 3.2.1, 3.2.0

OVERVIEW¶

Stored XSS Vulnerability in WSO2 Publisher Portal and Developer Portal.

DESCRIPTION¶

Insufficient HTML sanitization allows untrusted user input to trigger malicious JavaScript execution in the Publisher Portal and Developer Portal.

IMPACT¶

Successful exploitation may result in the execution of malicious scripts when affected API documents are viewed. Users with permission to access the API documentation through the Publisher Portal or Developer Portal may be impacted, potentially allowing attackers to perform actions within the context of the user’s session depending on the user’s privileges.

SOLUTION¶

Community Users (Open Source)¶

Apply the relevant fixes to your product using the public fix(es) provided below.

• https://github.com/wso2/apim-apps/pull/1287

If applying the fix or update is not feasible, migrate to the latest unaffected version of the respective WSO2 product(s).

Support Subscription Holders¶

Update your product to the specified update level or a higher update level to apply the fix.

After applying the provided update or public PR to the affected product versions, it is necessary to follow the below given instruction.

This update introduces a new configuration option called sanitizeHtmlDocs. This option is now available in the settings for both the Publisher Portal and the Developer Portal, allowing users to enable HTML sanitization for API documentation content displayed within these portals.

WSO2 API Manager 4.2.0, 4.3.0, 4.4.0, 4.5.0 and 4.6.0:

Add the 'sanitizeHtmlDocs' configuration to the 'settings.json' files found in the following locations.

• <APIM_HOME>/repository/deployment/server/webapps/publisher/site/public/conf/settings.json
• <APIM_HOME>/repository/deployment/server/webapps/devportal/site/public/theme/settings.json

{
  "app": {
    // Other configurations...
    "sanitizeHtmlDocs": {
      "enabled": true,
      "additionalAllowedTags": [],  // e.g., ["iframe", "svg"]
      "additionalAllowedAttributes": [] // e.g., ["onclick"]
    }
  }
}

WSO2 API Manager 3.2.0, 3.2.1 and 4.1.0:

Add the 'sanitizeHtmlDocs' configuration to the 'settings.js' files located in <APIM_HOME>/repository/deployment/server/jaggeryapps/publisher/site/public/conf

const AppConfig = {
  // ... Existing configurations

  app: {
    // ... Existing configurations

    /**
     * Configuration for HTML sanitization of documents.
     */
    sanitizeHtmlDocs: {
      /**
       * Flag to enable or disable HTML sanitization.
       */
      enabled: true,

      /**
       * A list of additional HTML tags allowed by the sanitizer.
       * Example: ["iframe", "svg"]
       */
      additionalAllowedTags: [],

      /**
       * A list of additional HTML attributes allowed by the sanitizer
       * Example: ["onclick"]
       */
      additionalAllowedAttributes: [],
    },
  },
};

Add the 'sanitizeHtmlDocs' configuration to the 'settings.js' files located in <APIM_HOME>/repository/deployment/server/jaggeryapps/devportal/site/public/theme

const Settings = {
  // ... Existing configurations ...

  app: {
    // ... Existing configurations ...

    /**
     * Configuration for HTML sanitization of documents.
     */
    sanitizeHtmlDocs: {
      /**
       * Flag to enable or disable HTML sanitization.
       */
      enabled: true,

      /**
       * A list of additional HTML tags allowed by the sanitizer.
       * Example: ["iframe", "svg"]
       */
      additionalAllowedTags: [],

      /**
       * A list of additional HTML attributes allowed by the sanitizer.
       * Example: ["onclick"]
       */
      additionalAllowedAttributes: [],
    },
  },
};

CREDITS¶

WSO2 thanks, San Gil from Security Office for responsibly reporting the identified issue and working with us as we addressed it.