HIGH🇵🇱 Wersja polska

CVE-2026-1010

CVSS 8.0v3.1pub. 2026-01-15upd. 2026-01-23

A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data. When an administrator views the affected workflow, the injected payload executes in the administrator’s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

  • Altium On Prem Enterprise Server

    APP
    Altium
    8.0.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSSLPE
CWE
References

Related vulnerabilities

CVE-2026-11414CRITICAL10.0PL ✓ten sam produkt

Altium Enterprise Server: hardcoded key + path traversal umożliwiają przejęcie serwera

CVE-2026-11419CRITICAL9.4PL ✓ten sam produkt

Path traversal w Altium Enterprise Server Vault Service — zapis dowolnych plików i RCE

CVE-2026-11420CRITICAL10.0PL ✓ten sam produkt

Path Traversal w Altium Enterprise Server NIS — nieuwierzytelniony RCE

CVE-2025-27378HIGH8.6ten sam produkt

AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsi...

CVE-2025-27380HIGH7.6ten sam produkt

HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authentic...