VulnerabilityAnalyzed

CVE-2026-1011

A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization.

MEDIUM 6.1EPSS 0.29%

Does this matter?

Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.

Description

A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTML and JavaScript supplied via modified POST requests. The injected content is rendered verbatim when support cases are viewed by other users, including support staff with elevated privileges, allowing execution of arbitrary JavaScript in the victim’s browser context.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.29% probability · 21th percentile
CISA KEV: Not listed
Weakness: CWE-79, CWE-116
Affected: altium/altium live
Source: 4760f414-e1ae-4ff1-bdad-c7a9c3538b79

References

https://www.altium.com/platform/security-compliance/security-advisoriesVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.