CVE-2026-1011

Stored Cross-Site Scripting in Altium Live Support Center Comment Endpoint

State: Published
Severity: 6.1 Medium
Published: Jan 15, 2026
Updated: Jan 29, 2026
Reserved: Jan 15, 2026

Description

A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTML and JavaScript supplied via modified POST requests.

The injected content is rendered verbatim when support cases are viewed by other users, including support staff with elevated privileges, allowing execution of arbitrary JavaScript in the victim’s browser context.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	Altium

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
CWE-116 Improper Encoding or Escaping of Output

Affected Products

Product	Versions
Altium LiveAltium	1.1.1.39 and earlierAffectedfrom 1.1.1.40Not affected

References

https://www.altium.com/platform/security-compliance/security-advisories

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.