PT-2026-3144 · Altium · Altium Support Center

Joris Aerts · Publicado 2026-01-15 · Atualizado 2026-01-16 · CVE-2026-1011

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Altium Support Center (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists in the AddComment API endpoint. The vulnerability is caused by a lack of server-side input sanitization. While the client interface applies HTML escaping, the backend stores arbitrary HTML and JavaScript received through modified POST requests. This allows for the execution of arbitrary JavaScript in the browser of users who view support cases, including those with elevated privileges. The AddComment endpoint is vulnerable. The vulnerable parameter is the POST request body.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Encoding or Escaping of Output

XSS

Enumeração de Fraquezas

CWE-116

CWE-79

Identificadores relacionados

CVE-2026-1011

Produtos afetados

Altium Support Center

Referências · 5

• https://altium.com/platform/security-compliance/security-advisories · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2012058718314115214 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-1011 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-1011 · Nota de Segurança
• https://twitter.com/CVEnew/status/2012126515371135342 · Publicação no Twitter