# CVE-2026-4103: WSO2 API Manager stored XSS in Publisher Portal and Developer Portal

Source: https://junglewise.ai/threats/cve-2026-4103-wso2-api-manager-stored-xss-in-publisher-portal-and-developer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-4103 · Severity: medium · CVSS 6.4 · Published 2026-09-14

WSO2 API Manager's Publisher Portal and Developer Portal allow API documentation to be created and viewed. A vulnerability in HTML sanitization permits attackers with portal access to inject malicious JavaScript code into API documents, which executes in users' browsers when those documents are viewed. This could allow attackers to steal session tokens, modify API configurations, or perform other actions on behalf of authenticated users.

Technologies: [Wso2 API Control Plane](https://junglewise.ai/threats/technologies/api-control-plane), [Wso2 API Manager](https://junglewise.ai/threats/technologies/api-manager). Vendors: [Wso2](https://junglewise.ai/threats/vendors/wso2).

## Quick answers

**Is CVE-2026-4103 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4103 being exploited in the wild.

**How severe is CVE-2026-4103?** Medium severity, with a CVSS score of 6.4, published 14 September 2026.

**Which products and versions are affected?** Wso2 API Control Plane 4.5.0, 4.6.0; Wso2 API Manager 3.2.0, 3.2.1, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0.

**Is there a fix for CVE-2026-4103?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-4103 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-4103?** Check whether you run Wso2 API Control Plane or Wso2 API Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability caused by insufficient HTML sanitization in the Publisher Portal and Developer Portal components. Untrusted user input is rendered without proper encoding or neutralization, allowing attackers to inject and execute arbitrary JavaScript. The vulnerability requires authentication (login to the portal) and affects API documentation viewing. Successful exploitation enables session hijacking, credential theft, or unauthorized actions within the attacker's privilege level. Patches are available as updates to affected versions (WSO2 API Manager 3.2.0–4.6.0 and WSO2 API Control Plane 4.5.0–4.6.0), requiring configuration of a new 'sanitizeHtmlDocs' setting to enable HTML sanitization.

## Affected products

- WSO2 API Manager 3.2.0, 3.2.1, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0
- WSO2 API Control Plane 4.5.0, 4.6.0

## Timeline

- 2026-07-04: disclosed
- 2026-07-04: advisory: WSO2-2026-4844

## References

- [https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-4844/](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-4844/)

## Related threats

- [WSO2 Identity Server privilege escalation via shared database](https://junglewise.ai/threats/cve-2026-4052-this-issue-only-impacts-deployments-where-wso2-identity-server-is)
- [WSO2 API Manager Admin REST API SQL injection](https://junglewise.ai/threats/cve-2026-2613-the-admin-rest-api-accepts-user-supplied-input-without-adequately)
- [WSO2 API Manager SVG upload stored XSS in Publisher portal](https://junglewise.ai/threats/cve-2025-12544-the-publisher-portal-fails-to-enforce-proper-validation-on)
- [WSO2 products sensitive information disclosure in Event Publisher logs](https://junglewise.ai/threats/cve-2026-18800-when-an-event-publisher-output-adapter-is-configured-with)
- [WSO2 System REST APIs access control bypass](https://junglewise.ai/threats/cve-2025-11969-the-system-rest-apis-do-not-correctly-enforce-access-control)