CVE Feed

    Dashboard / CVE / CVE-2026-1010

    CVE-2026-1010

    A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data. When an administrator views the affected workflow, the injected payload executes in the administrator’s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions.

    Published:Jan 15, 2026
    Last Modified:Apr 18, 2026
    EPS:Jan 15, 2026
    EPSS Score:0.00016
    CVSS Score:8

    Affected Products

    Vendor
    Altium
    Product
    Altium 365
    Vendor
    Altium
    Product
    On-prem Enterprise Server

    Exploits

    https://github.com/George0Papasotiriou/CVE-2026-1010-WebSocket-Connection-Smuggling-via-Malformed-Upgrade-Header

    Related CVEs

    CVE-2026-14439 (CVSS 9.4) — A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Alti…
    CVE-2026-11431 (CVSS 8.3) — A path traversal vulnerability exists in the Projects Service download endpoint shared by Altium Enterprise Se…
    CVE-2026-11429 (CVSS 10) — Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accep…
    CVE-2026-11424 (CVSS 8.3) — A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Ente…
    CVE-2026-9152 (CVSS 10) — A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes …
    CVE-2026-1181 (CVSS 9) — Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) …
    CVE-2026-1011 (CVSS 6.1) — A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due …
    CVE-2026-1009 (CVSS 9) — A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input …
    CVE-2026-1008 (CVSS 7.6) — A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insuff…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High