CVE-2026-1181
Stored XSS in Altium Forum Enables Authenticated Data Access
Publication date: 2026-01-19
Last updated on: 2026-01-19
Assigner: Altium
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| altium | forum | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stored cross-site scripting (XSS) issue in the Altium Forum caused by missing server-side input sanitization in forum post content. An authenticated attacker can inject malicious JavaScript code into forum posts, which is then stored and executed when other users view the infected post.
How can this vulnerability impact me? :
Exploitation of this vulnerability allows the attacker's malicious script to run in the context of the victim's authenticated Altium 365 session. This can lead to unauthorized access to sensitive workspace data, including design files and workspace settings. The attack requires the victim to interact by viewing the malicious forum post.