CVE-2026-1009

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1009", "assignerOrgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "state": "PUBLISHED", "assignerShortName": "Altium", "dateReserved": "2026-01-15T22:08:45.185Z", "datePublished": "2026-01-15T22:51:32.441Z", "dateUpdated": "2026-01-20T20:15:28.251Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Forum post editing and rendering"], "platforms": ["Web"], "product": "Altium Live", "vendor": "Altium", "versions": [{"changes": [{"at": "1.2.3", "status": "unaffected"}], "lessThanOrEqual": "1.2.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "datePublic": "2026-01-15T22:48:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed when other users view the affected post.<br>Successful exploitation allows the attacker\u2019s payload to execute in the context of the victim\u2019s authenticated Altium 365 session, enabling unauthorized access to workspace data, including design files and workspace settings. Exploitation requires user interaction to view a malicious forum post.<br>"}], "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed when other users view the affected post.\nSuccessful exploitation allows the attacker\u2019s payload to execute in the context of the victim\u2019s authenticated Altium 365 session, enabling unauthorized access to workspace data, including design files and workspace settings. Exploitation requires user interaction to view a malicious forum post."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting"}]}, {"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "shortName": "Altium", "dateUpdated": "2026-01-20T20:15:28.251Z"}, "references": [{"url": "https://www.altium.com/platform/security-compliance/security-advisories"}], "source": {"discovery": "UNKNOWN"}, "title": "Stored Cross-Site Scripting in Altium Live Forum Leading to Cross-Customer Data Exposure", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T17:17:26.393184Z", "id": "CVE-2026-1009", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T17:17:45.223Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1009", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-16T17:17:26.393184Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T17:17:37.928Z"}}], "cna": {"title": "Stored Cross-Site Scripting in Altium Live Forum Leading to Cross-Customer Data Exposure", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting"}]}, {"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Altium", "modules": ["Forum post editing and rendering"], "product": "Altium Live", "versions": [{"status": "affected", "changes": [{"at": "1.2.3", "status": "unaffected"}], "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.2"}], "platforms": ["Web"], "defaultStatus": "unaffected"}], "datePublic": "2026-01-15T22:48:00.000Z", "references": [{"url": "https://www.altium.com/platform/security-compliance/security-advisories"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed when other users view the affected post.\nSuccessful exploitation allows the attacker\u2019s payload to execute in the context of the victim\u2019s authenticated Altium 365 session, enabling unauthorized access to workspace data, including design files and workspace settings. Exploitation requires user interaction to view a malicious forum post.", "supportingMedia": [{"type": "text/html", "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed when other users view the affected post.<br>Successful exploitation allows the attacker\u2019s payload to execute in the context of the victim\u2019s authenticated Altium 365 session, enabling unauthorized access to workspace data, including design files and workspace settings. Exploitation requires user interaction to view a malicious forum post.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "shortName": "Altium", "dateUpdated": "2026-01-20T20:15:28.251Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1009", "state": "PUBLISHED", "dateUpdated": "2026-01-20T20:15:28.251Z", "dateReserved": "2026-01-15T22:08:45.185Z", "assignerOrgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "datePublished": "2026-01-15T22:51:32.441Z", "assignerShortName": "Altium"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Forum post editing and rendering"], "platforms": ["Web"], "product": "Altium Live", "vendor": "Altium", "versions": [{"changes": [{"at": "1.2.3", "status": "unaffected"}], "lessThanOrEqual": "1.2.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:altium:altium_live:1.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "E75C3257-AC40-4BC5-BEBA-492D4DECCFC1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed when other users view the affected post.\nSuccessful exploitation allows the attacker\u2019s payload to execute in the context of the victim\u2019s authenticated Altium 365 session, enabling unauthorized access to workspace data, including design files and workspace settings. Exploitation requires user interaction to view a malicious forum post."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) almacenado existe en el Foro de Altium debido a la falta de sanitizaci\u00f3n de entrada del lado del servidor en el contenido de las publicaciones del foro. Un atacante autenticado puede inyectar JavaScript arbitrario en las publicaciones del foro, el cual se almacena y ejecuta cuando otros usuarios ven la publicaci\u00f3n afectada.\nLa explotaci\u00f3n exitosa permite que la carga \u00fatil del atacante se ejecute en el contexto de la sesi\u00f3n autenticada de Altium 365 de la v\u00edctima, lo que permite el acceso no autorizado a los datos del espacio de trabajo, incluyendo archivos de dise\u00f1o y configuraciones del espacio de trabajo. La explotaci\u00f3n requiere interacci\u00f3n del usuario para ver una publicaci\u00f3n de foro maliciosa."}], "id": "CVE-2026-1009", "lastModified": "2026-06-17T10:14:52.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1009", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T17:17:26.393184Z", "version": "2.0.3"}}]}, "published": "2026-01-15T23:15:51.153", "references": [{"source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "tags": ["Vendor Advisory"], "url": "https://www.altium.com/platform/security-compliance/security-advisories"}], "sourceIdentifier": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-284"}], "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T05:53:55.761805+00:00", "value": {"mitigation_remediation": ["Apply the latest Altium Live patch or upgrade to a version that includes server\u2011side input sanitization for forum posts", "Configure the forum to disallow script tags and enforce strict content filtering before storing posts", "Deploy a web application firewall rule that detects and blocks embedded JavaScript in forum content"], "summary": {"action": "Patch Now", "impact": "Privileged data exposure via stored XSS"}, "threat_synthesis": {"affected_systems": "Altium Live version 1.2.2. No other affected versions are listed.", "description_and_impact": "A stored cross\u2011site scripting flaw in Altium Live Forum allows an authenticated user to inject arbitrary JavaScript into post content. The malicious script is stored and then executed when other users view the post. Because the script runs in the victim\u2019s authenticated Altium 365 session, it can read sensitive workspace data including design files and settings, effectively granting the attacker unauthorized access to privileged information.", "risk_and_exploitability": "This vulnerability carries a CVSS score of 9, indicating high severity, while the EPSS probability is very low (< 1\u202f%) and it is not listed in the KEV catalog. The attack requires an attacker to create a post containing the exploit and a victim to view that post, so interaction from the victim is necessary for execution. Once the script runs, it can read or exfiltrate sensitive data within the user\u2019s authenticated session."}}}}, "created": "2026-01-16T13:42:11.197057+00:00", "updated": "2026-04-18T06:00:08.494564+00:00", "vendors": ["altium", "altium$PRODUCT$altium_365"]}