CVE Feed

    Dashboard / CVE / CVE-2026-1011

    CVE-2026-1011

    A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTML and JavaScript supplied via modified POST requests. The injected content is rendered verbatim when support cases are viewed by other users, including support staff with elevated privileges, allowing execution of arbitrary JavaScript in the victim’s browser context.

    Published:Jan 15, 2026
    Last Modified:Apr 18, 2026
    EPS:Jan 15, 2026
    EPSS Score:0.00017
    CVSS Score:6.1

    Affected Products

    Vendor
    Altium
    Product
    Altium 365
    Vendor
    Altium
    Product
    Altium Live

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-14439 (CVSS 9.4) — A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Alti…
    CVE-2026-11431 (CVSS 8.3) — A path traversal vulnerability exists in the Projects Service download endpoint shared by Altium Enterprise Se…
    CVE-2026-11429 (CVSS 10) — Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accep…
    CVE-2026-11424 (CVSS 8.3) — A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Ente…
    CVE-2026-9152 (CVSS 10) — A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes …
    CVE-2026-1181 (CVSS 9) — Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) …
    CVE-2026-1010 (CVSS 8) — A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-s…
    CVE-2026-1009 (CVSS 9) — A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input …
    CVE-2026-1008 (CVSS 7.6) — A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insuff…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-1011 — Altium (Medium 6.1) | CVE-DB