CVE-2026-1010

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1010", "assignerOrgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "state": "PUBLISHED", "assignerShortName": "Altium", "dateReserved": "2026-01-15T22:08:47.337Z", "datePublished": "2026-01-15T23:00:18.163Z", "dateUpdated": "2026-02-05T22:07:23.193Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Workflow Engine (Part Request submit-form API)"], "platforms": ["Web"], "product": "Altium Enterprise Server", "vendor": "Altium", "versions": [{"lessThanOrEqual": "8.0.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "datePublic": "2026-01-15T22:58:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data.<br><br>When an administrator views the affected workflow, the injected payload executes in the administrator\u2019s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions.<br><br>"}], "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data.\n\nWhen an administrator views the affected workflow, the injected payload executes in the administrator\u2019s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}, {"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "shortName": "Altium", "dateUpdated": "2026-02-05T22:07:23.193Z"}, "references": [{"url": "https://www.altium.com/platform/security-compliance/security-advisories"}], "source": {"discovery": "UNKNOWN"}, "title": "Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T17:05:21.932214Z", "id": "CVE-2026-1010", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T17:05:38.769Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1010", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-16T17:05:21.932214Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T17:05:28.562Z"}}], "cna": {"title": "Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}, {"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Altium", "modules": ["Workflow Engine (Part Request submit-form API)"], "product": "Altium Enterprise Server", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.0.1"}], "platforms": ["Web"], "defaultStatus": "unaffected"}], "datePublic": "2026-01-15T22:58:00.000Z", "references": [{"url": "https://www.altium.com/platform/security-compliance/security-advisories"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data.\n\nWhen an administrator views the affected workflow, the injected payload executes in the administrator\u2019s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions.", "supportingMedia": [{"type": "text/html", "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data.<br><br>When an administrator views the affected workflow, the injected payload executes in the administrator\u2019s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions.<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "shortName": "Altium", "dateUpdated": "2026-02-05T22:07:23.193Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1010", "state": "PUBLISHED", "dateUpdated": "2026-02-05T22:07:23.193Z", "dateReserved": "2026-01-15T22:08:47.337Z", "assignerOrgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "datePublished": "2026-01-15T23:00:18.163Z", "assignerShortName": "Altium"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Workflow Engine (Part Request submit-form API)"], "platforms": ["Web"], "product": "Altium Enterprise Server", "vendor": "Altium", "versions": [{"lessThanOrEqual": "8.0.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:altium:on-prem_enterprise_server:8.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "CDEBB57C-6A6D-4FC9-BA14-8324F1F7661C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data.\n\nWhen an administrator views the affected workflow, the injected payload executes in the administrator\u2019s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) almacenado existe en el Altium Workflow Engine debido a la falta de saneamiento de entrada del lado del servidor en las API de env\u00edo de formularios de flujo de trabajo. Un usuario autenticado regular puede inyectar JavaScript arbitrario en los datos del flujo de trabajo.\n\nCuando un administrador ve el flujo de trabajo afectado, la carga \u00fatil inyectada se ejecuta en el contexto del navegador del administrador, permitiendo la escalada de privilegios, incluyendo la creaci\u00f3n de nuevas cuentas de administrador, el robo de tokens de sesi\u00f3n y la ejecuci\u00f3n de acciones administrativas."}], "id": "CVE-2026-1010", "lastModified": "2026-06-17T10:14:52.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1010", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T17:05:21.932214Z", "version": "2.0.3"}}]}, "published": "2026-01-15T23:15:51.323", "references": [{"source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "tags": ["Vendor Advisory"], "url": "https://www.altium.com/platform/security-compliance/security-advisories"}], "sourceIdentifier": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-269"}], "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T05:52:53.777958+00:00", "value": {"mitigation_remediation": ["Upgrade to a version of Altium Enterprise Server that contains the official patch for the Workflow Engine XSS flaw.", "If an immediate patch is unavailable, implement server\u2011side validation that rejects or escapes all non\u2011alphanumeric characters in workflow form fields and enforce a strict content\u2011security\u2011policy header to limit script execution.", "Restrict workflow viewing permissions to only necessary administrators and audit new administrator account creation logs for suspicious activity."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation via Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Altium Enterprise Server version 8.0.1 is impacted. No other affected versions were specified in the advisory.", "description_and_impact": "A stored cross\u2011site scripting flaw exists in the Altium Enterprise Server Workflow Engine caused by missing server\u2011side sanitization of workflow form submissions. An authenticated user can inject arbitrary JavaScript into workflow data that is later rendered when an administrator opens the workflow. The injected script runs in the administrator\u2019s browser context, enabling the attacker to create new administrator accounts, steal session tokens, and perform any administrative action. This vulnerability is a direct privilege escalation mechanism rooted in a client\u2011side scripting weakness (CWE-79) that yields complete control over privileged accounts (CWE-269).", "risk_and_exploitability": "The baseline CVSS score of 8.0 indicates high impact, while the EPSS score of less than 1% suggests that exploit activity is currently very rare. The vulnerability is not listed in the CISA KEV catalog. The likely attack path requires an authenticated non\u2011administrator to submit malicious workflow data and a separate step where an administrator opens the compromised workflow. Once the administrator views the data, the payload executes immediately in the admin\u2019s browser session. Because the vulnerability depends on an additional privileged user action, the overall exploitation feasibility is moderate, but the resulting impact is severe."}}}}, "created": "2026-01-16T13:42:26.868321+00:00", "updated": "2026-04-18T06:00:08.492152+00:00", "vendors": ["altium", "altium$PRODUCT$altium_365"]}