{"id":"CVE-2026-1010","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-1010","generatedAt":"2026-10-28T04:16:02.042Z","title":"A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs.","description":"A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data.\n\nWhen an administrator views the affected workflow, the injected payload executes in the administrator’s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions.","published":"2026-01-15T23:15:51.000Z","lastModified":"2026-06-17T10:14:52.000Z","status":"Analyzed","sourceIdentifier":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79","cvss":{"version":"3.1","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79","CWE-269"],"affected":["altium/on-prem enterprise server"],"epss":{"score":0.00337,"percentile":0.26988,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://www.altium.com/platform/security-compliance/security-advisories","tags":["Vendor Advisory"],"source":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-1010","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}