Vulnerability Report

CVE-2026-1011

Title: Stored XSS in Altium Support Center

XSS

Proof Of Concept

No public PoC currently indexed for CVE-2026-1011.

CWE Category CWE-79

Published Date Jan 16, 2026

Modified Date Jan 23, 2026

Exploit Status Not Found

Score 6.1 CVSS v3.1

Exploit Probability (EPSS)

0.26%

Vulnerability Summary

CVE-2026-1011: A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTML and JavaScript supplied via modified POST requests. The injected content is rendered verbatim when support cases are viewed by other users, including support staff with elevated privileges, allowing execution of arbitrary JavaScript in the victim’s browser context.

Impacted Vendors

altium 1

Reference Links

https://www.altium.com/platform/security-compliance/security-advisories

CVSS v3.1

Source Entity 4760f414-e1ae-4ff1-bdad-c7a9c3538b79

Severity MEDIUM

6.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns