Executive brief
WSO2 API Manager's Publisher Portal and Developer Portal allow API documentation to be created and viewed. A vulnerability in HTML sanitization permits attackers with portal access to inject malicious JavaScript code into API documents, which executes in users' browsers when those documents are viewed. This could allow attackers to steal session tokens, modify API configurations, or perform other actions on behalf of authenticated users.
Technical details
This is a stored cross-site scripting (XSS) vulnerability caused by insufficient HTML sanitization in the Publisher Portal and Developer Portal components. Untrusted user input is rendered without proper encoding or neutralization, allowing attackers to inject and execute arbitrary JavaScript. The vulnerability requires authentication (login to the portal) and affects API documentation viewing. Successful exploitation enables session hijacking, credential theft, or unauthorized actions within the attacker's privilege level. Patches are available as updates to affected versions (WSO2 API Manager 3.2.0–4.6.0 and WSO2 API Control Plane 4.5.0–4.6.0), requiring configuration of a new 'sanitizeHtmlDocs' setting to enable HTML sanitization.
Affected products
- WSO2 API Manager 3.2.0, 3.2.1, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0
- WSO2 API Control Plane 4.5.0, 4.6.0
Timeline
- 2026-07-04: disclosed
- 2026-07-04: advisory: WSO2-2026-4844