Vulnerability · Published Jan 15, 2026 · Assigned by Altium
CVE-2026-1010Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation
High 8.0
In plain English
A high-severity cross-site scripting in Altium Enterprise Server from Altium. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data. When an administrator views the affected workflow, the injected payload executes in the administrator’s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Altium | Altium Enterprise Server | 0 – through 8.0.1 |
Weakness: CWE-79, CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H