Description
The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal.

By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services.
Published: 2026-08-06
Score: 4.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Swagger UI Try‑out console in the WSO2 API Publisher can load an external Swagger API definition URL and overwrite the existing API definitions displayed to the user. By doing so, a malicious actor can present a forged API to the portal users, potentially exposing sensitive information or causing the user to initiate unintended requests to backend services. The weakness originates from insufficient validation of external Swagger definitions (CWE‑79).

Affected Systems

This issue affects the WSO2 API Manager platform. No specific affected versions are listed in the advisory, so all installations of WSO2 API Manager are considered potentially vulnerable until a vendor patch is applied.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a user to interact with the broken Swagger UI console and supply a malicious Swagger definition URL; therefore, exploitation is contingent on the user’s actions within the web interface.

Generated by OpenCVE AI on August 6, 2026 at 23:21 UTC.

Remediation

Vendor Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4306/#solution

OpenCVE Recommended Actions

  • Follow the vendor‑provided update instructions published on the WSO2 security advisory website to patch the affected component.
  • Configure or disable the Swagger UI Try‑out console’s ability to load external Swagger definition URLs to prevent overwriting of official API definitions.
  • Apply stricter access controls and monitor API usage logs for anomalous requests originating from the API Publisher portal.

Generated by OpenCVE AI on August 6, 2026 at 23:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Wso2 api Manager
Vendors & Products Wso2 api Manager

Thu, 06 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services.
Title User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests
First Time appeared Wso2
Wso2 wso2 Api Manager
Weaknesses CWE-79
CPEs cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*
Vendors & Products Wso2
Wso2 wso2 Api Manager
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

Wso2 Api Manager Wso2 Api Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: WSO2

Published:

Updated: 2026-08-06T17:32:02.252Z

Reserved: 2025-06-23T08:43:04.084Z

Link: CVE-2025-6508

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T23:30:05Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')