CVE-2026-1008

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1008", "assignerOrgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "state": "PUBLISHED", "assignerShortName": "Altium", "dateReserved": "2026-01-15T22:08:25.034Z", "datePublished": "2026-01-15T22:24:16.136Z", "dateUpdated": "2026-01-19T11:42:46.627Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["User Profile service"], "platforms": ["Web"], "product": "Altium Live", "vendor": "Altium", "versions": [{"changes": [{"at": "1.2.3", "status": "unaffected"}], "lessThanOrEqual": "1.2.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "datePublic": "2026-01-15T22:17:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute parsing bypass techniques.<br>The injected payload is persisted and executed when other users view the affected profile page, potentially allowing session token theft, phishing attacks, or malicious redirects. Exploitation requires an authenticated account and user interaction to view the crafted profile.<br>"}], "value": "A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute parsing bypass techniques.\nThe injected payload is persisted and executed when other users view the affected profile page, potentially allowing session token theft, phishing attacks, or malicious redirects. Exploitation requires an authenticated account and user interaction to view the crafted profile."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "shortName": "Altium", "dateUpdated": "2026-01-19T11:42:46.627Z"}, "references": [{"url": "https://www.altium.com/platform/security-compliance/security-advisories"}], "source": {"discovery": "UNKNOWN"}, "title": "Stored Cross-Site Scripting in Altium Live User Profile Fields", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T14:48:14.702742Z", "id": "CVE-2026-1008", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T14:51:18.142Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1008", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T14:48:14.702742Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T14:51:10.306Z"}}], "cna": {"title": "Stored Cross-Site Scripting in Altium Live User Profile Fields", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Altium", "modules": ["User Profile service"], "product": "Altium Live", "versions": [{"status": "affected", "changes": [{"at": "1.2.3", "status": "unaffected"}], "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.2"}], "platforms": ["Web"], "defaultStatus": "unaffected"}], "datePublic": "2026-01-15T22:17:00.000Z", "references": [{"url": "https://www.altium.com/platform/security-compliance/security-advisories"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute parsing bypass techniques.\nThe injected payload is persisted and executed when other users view the affected profile page, potentially allowing session token theft, phishing attacks, or malicious redirects. Exploitation requires an authenticated account and user interaction to view the crafted profile.", "supportingMedia": [{"type": "text/html", "value": "A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute parsing bypass techniques.<br>The injected payload is persisted and executed when other users view the affected profile page, potentially allowing session token theft, phishing attacks, or malicious redirects. Exploitation requires an authenticated account and user interaction to view the crafted profile.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)"}]}], "providerMetadata": {"orgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "shortName": "Altium", "dateUpdated": "2026-01-19T11:42:46.627Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1008", "state": "PUBLISHED", "dateUpdated": "2026-01-19T11:42:46.627Z", "dateReserved": "2026-01-15T22:08:25.034Z", "assignerOrgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "datePublished": "2026-01-15T22:24:16.136Z", "assignerShortName": "Altium"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["User Profile service"], "platforms": ["Web"], "product": "Altium Live", "vendor": "Altium", "versions": [{"changes": [{"at": "1.2.3", "status": "unaffected"}], "lessThanOrEqual": "1.2.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:altium:altium_live:1.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "E75C3257-AC40-4BC5-BEBA-492D4DECCFC1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute parsing bypass techniques.\nThe injected payload is persisted and executed when other users view the affected profile page, potentially allowing session token theft, phishing attacks, or malicious redirects. Exploitation requires an authenticated account and user interaction to view the crafted profile."}, {"lang": "es", "value": "Existe una vulnerabilidad de cross-site scripting (XSS) almacenado en los campos de texto del perfil de usuario de Altium 365. Una sanitizaci\u00f3n de entrada insuficiente por parte del servidor permite a los usuarios autenticados inyectar cargas \u00fatiles arbitrarias de HTML y JavaScript utilizando t\u00e9cnicas de omisi\u00f3n de an\u00e1lisis de atributos basadas en espacios en blanco.\nLa carga \u00fatil inyectada se persiste y se ejecuta cuando otros usuarios ven la p\u00e1gina de perfil afectada, lo que podr\u00eda permitir el robo de tokens de sesi\u00f3n, ataques de phishing o redirecciones maliciosas. La explotaci\u00f3n requiere una cuenta autenticada e interacci\u00f3n del usuario para ver el perfil manipulado."}], "id": "CVE-2026-1008", "lastModified": "2026-06-17T10:14:52.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.7, "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1008", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T14:48:14.702742Z", "version": "2.0.3"}}]}, "published": "2026-01-15T23:15:50.970", "references": [{"source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "tags": ["Vendor Advisory"], "url": "https://www.altium.com/platform/security-compliance/security-advisories"}], "sourceIdentifier": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:07:21.496394+00:00", "value": {"mitigation_remediation": ["Apply the official Altium Live patch that addresses the XSS flaw once released.", "Configure a strict Content\u2011Security\u2011Policy that disallows inline scripts and limits script sources.", "Enforce server\u2011side sanitization of profile text fields or restrict editing to trusted users."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting leading to session hijacking or phishing"}, "threat_synthesis": {"affected_systems": "Altium Live is the affected product, specifically version 1.2.2. The issue is present in the user profile editing functionality of Altium 365, requiring an authenticated user to supply malicious content.", "description_and_impact": "A stored cross\u2011site scripting vulnerability resides in the user profile text fields of Altium Live. Insufficient server\u2011side sanitization allows authenticated users to inject arbitrary HTML and JavaScript. When an impacted profile is viewed, the payload is executed in the victim\u2019s browser, enabling session token theft, phishing, or malicious redirects. The weakness is a classic input validation flaw.", "risk_and_exploitability": "The CVSS score of 7.6 indicates a high severity. The EPSS score is below 1\u202f%, suggesting exploitation is unlikely but not impossible; it is not listed in the CISA KEV catalog. Exploitation demands an authenticated account and a victim who visits the altered profile, so the attack vector is limited to social\u2011engineering or internal user interaction. The vulnerability\u2019s impact is confined to the user\u2019s browser context, but it can lead to credential compromise and further lateral movement."}}}}, "created": "2026-01-16T13:42:55.380044+00:00", "updated": "2026-04-18T16:15:04.601146+00:00", "vendors": ["altium", "altium$PRODUCT$altium_365"]}