CVE-2026-1011

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1011", "assignerOrgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "state": "PUBLISHED", "assignerShortName": "Altium", "dateReserved": "2026-01-15T22:08:48.882Z", "datePublished": "2026-01-15T23:08:01.260Z", "dateUpdated": "2026-01-29T16:49:40.462Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Support case comment rendering (AddComment endpoint)"], "platforms": ["Web"], "product": "Altium Live", "vendor": "Altium", "versions": [{"changes": [{"at": "1.1.1.40", "status": "unaffected"}], "lessThanOrEqual": "1.1.1.39", "status": "affected", "version": "0", "versionType": "semver"}]}], "datePublic": "2026-01-15T23:01:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTML and JavaScript supplied via modified POST requests.<br><br>The injected content is rendered verbatim when support cases are viewed by other users, including support staff with elevated privileges, allowing execution of arbitrary JavaScript in the victim\u2019s browser context.<br><br>"}], "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTML and JavaScript supplied via modified POST requests.\n\nThe injected content is rendered verbatim when support cases are viewed by other users, including support staff with elevated privileges, allowing execution of arbitrary JavaScript in the victim\u2019s browser context."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting"}]}, {"capecId": "CAPEC-98", "descriptions": [{"lang": "en", "value": "CAPEC-98 Phishing"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "shortName": "Altium", "dateUpdated": "2026-01-22T01:39:11.948Z"}, "references": [{"url": "https://www.altium.com/platform/security-compliance/security-advisories"}], "source": {"discovery": "UNKNOWN"}, "title": "Stored Cross-Site Scripting in Altium Live Support Center Comment Endpoint", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T17:04:46.841715Z", "id": "CVE-2026-1011", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T16:49:40.462Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1011", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T17:04:46.841715Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T16:35:23.184Z"}}], "cna": {"title": "Stored Cross-Site Scripting in Altium Live Support Center Comment Endpoint", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting"}]}, {"capecId": "CAPEC-98", "descriptions": [{"lang": "en", "value": "CAPEC-98 Phishing"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Altium", "modules": ["Support case comment rendering (AddComment endpoint)"], "product": "Altium Live", "versions": [{"status": "affected", "changes": [{"at": "1.1.1.40", "status": "unaffected"}], "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.1.39"}], "platforms": ["Web"], "defaultStatus": "unaffected"}], "datePublic": "2026-01-15T23:01:00.000Z", "references": [{"url": "https://www.altium.com/platform/security-compliance/security-advisories"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTML and JavaScript supplied via modified POST requests.\n\nThe injected content is rendered verbatim when support cases are viewed by other users, including support staff with elevated privileges, allowing execution of arbitrary JavaScript in the victim\u2019s browser context.", "supportingMedia": [{"type": "text/html", "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTML and JavaScript supplied via modified POST requests.<br><br>The injected content is rendered verbatim when support cases are viewed by other users, including support staff with elevated privileges, allowing execution of arbitrary JavaScript in the victim\u2019s browser context.<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "shortName": "Altium", "dateUpdated": "2026-01-22T01:39:11.948Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1011", "state": "PUBLISHED", "dateUpdated": "2026-01-29T16:49:40.462Z", "dateReserved": "2026-01-15T22:08:48.882Z", "assignerOrgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "datePublished": "2026-01-15T23:08:01.260Z", "assignerShortName": "Altium"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Support case comment rendering (AddComment endpoint)"], "platforms": ["Web"], "product": "Altium Live", "vendor": "Altium", "versions": [{"changes": [{"at": "1.1.1.40", "status": "unaffected"}], "lessThanOrEqual": "1.1.1.39", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:altium:altium_live:*:*:*:*:*:*:*:*", "matchCriteriaId": "079E28E9-A5B9-49AF-8D96-B56C46DB5231", "versionEndIncluding": "1.1.1.39", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTML and JavaScript supplied via modified POST requests.\n\nThe injected content is rendered verbatim when support cases are viewed by other users, including support staff with elevated privileges, allowing execution of arbitrary JavaScript in the victim\u2019s browser context."}, {"lang": "es", "value": "Existe una vulnerabilidad de cross-site scripting (XSS) almacenado en el endpoint AddComment del Centro de Soporte de Altium debido a la falta de sanitizaci\u00f3n de entrada del lado del servidor. Aunque la interfaz del cliente aplica escape de HTML, el backend acepta y almacena HTML y JavaScript arbitrarios suministrados a trav\u00e9s de solicitudes POST modificadas.\n\nEl contenido inyectado se renderiza textualmente cuando otros usuarios ven los casos de soporte, incluido el personal de soporte con privilegios elevados, lo que permite la ejecuci\u00f3n de JavaScript arbitrario en el contexto del navegador de la v\u00edctima."}], "id": "CVE-2026-1011", "lastModified": "2026-06-17T10:14:52.423", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1011", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T17:04:46.841715Z", "version": "2.0.3"}}]}, "published": "2026-01-16T00:16:29.050", "references": [{"source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "tags": ["Vendor Advisory"], "url": "https://www.altium.com/platform/security-compliance/security-advisories"}], "sourceIdentifier": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-116"}], "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T19:10:10.221971+00:00", "value": {"mitigation_remediation": ["Verify whether Altium has released a patch or hotfix that implements server\u2011side sanitization for the AddComment endpoint; if available, apply the update immediately.", "In the absence of a vendor fix, deploy an application\u2011layer filtering mechanism such as a web\u2011application firewall or API gateway to strip or neutralise dangerous content (e.g., <script> tags, event\u2011handler attributes) before comments are stored in the database.", "Restrict comment posting privileges to trusted users or introduce a manual moderation workflow that reviews and sanitises comment content prior to storage, thereby limiting the amount of untrusted data entering the system."], "summary": {"action": "Assess Impact", "impact": "Stored Cross\u2011Site Scripting via AddComment Endpoint"}, "threat_synthesis": {"affected_systems": "The affected product is Altium Live, specifically the AddComment endpoint within the Altium Live Support Center. The advisory does not specify a particular version number, implying that any deployment of Altium Live that exposes this endpoint without server\u2011side sanitization is vulnerable. Administrators and support staff who view support cases will be impacted when malicious content is stored, regardless of the specific release version.\n", "description_and_impact": "A stored cross\u2011site scripting flaw is present in the Altium Live Support Center\u2019s AddComment endpoint. The backend accepts and retains arbitrary HTML and JavaScript embedded in comment payloads because it does not perform server\u2011side sanitization, despite client\u2011side HTML escaping. When a support case is subsequently displayed to another user, including administrators, the unsanitized payload is rendered directly by the victim\u2019s browser, allowing the attacker to execute arbitrary JavaScript in that user\u2019s context. The impact is limited to the client\u2019s browser; there is no host\u2011level code execution or data modification on the server, but the attacker can exfiltrate session data, inject malicious logic, or impersonate the victim within the support portal.\n\nThis vulnerability is a classic example of a CWEs that involve improper output encoding (CWE\u201179) and incorrect handling of content types (CWE\u2011116). It represents a medium severity flaw due to the requirement for the target to view the compromised case.\n\nThe stored nature of the payload means that the vulnerability can be exploited repeatedly by injecting a single comment and waiting for others to view it. While the EPSS score of < 1\u202f% indicates a low likelihood of current exploitation, the flaw remains publicly documented and is not listed in the CISA KEV catalog, so organizations using Altium Live should monitor for usage or apply the recommended mitigations.\n", "risk_and_exploitability": "An attacker can exploit this flaw by crafting a malicious POST request to the AddComment endpoint, inserting arbitrary script tags or event handlers into the comment content. The likely attack vector is web\u2011based: the attacker does not need privileged credentials beyond the ability to post a comment, and the injected code executes in the browser context of any user who later opens the affected support case. The CVSS base score of 6.1 reflects the medium impact, and the EPSS score of < 1\u202f% suggests that real\u2011world exploitation is currently low, although the vulnerability is publicly known. The flaw is not associated with the KEV catalog, which indicates no known widespread exploitation, but the potential for social\u2010engineering or internal misuse keeps the risk relevant.\n"}}}}, "created": "2026-01-16T13:42:01.563636+00:00", "updated": "2026-04-18T19:15:10.613224+00:00", "vendors": ["altium", "altium$PRODUCT$altium_365"]}