Executive brief
WSO2 API Manager's API Publisher portal includes a Swagger UI Try-out console that allows users to test API definitions. A vulnerability allows attackers to load external Swagger API definitions that override the legitimate ones, tricking users into sending requests to attacker-controlled backend services or exposing sensitive information during interaction with the fraudulent definitions.
Technical details
The vulnerability is a UI misrepresentation flaw in the Swagger UI Try-out console integrated within the API Publisher documentation module. The root cause is insecure handling of external Swagger API definition URLs, which allows an attacker to supply a malicious URL that overrides the legitimate API definitions stored in the Publisher portal. The attack requires user interaction (UI:R) and network reachability with no prior authentication needed (PR:N). An attacker can craft a phishing link or social engineering attack that directs a user to access the API Publisher with a specially crafted parameter pointing to a malicious Swagger definition URL, causing the console to load attacker-controlled API specifications. This could lead to unintended API requests sent to attacker infrastructure or disclosure of sensitive data. WSO2 provides fixes via update levels: API Manager 4.2.0 requires update 183, and 4.1.0 requires update 212.
Affected products
- WSO2 API Manager 4.1.0, 4.2.0
Timeline
- 2026-05-03: disclosed
- 2026-08-06: published