PT-2026-3437 · Altium · Altium 365+1

Joris Aerts · Publicado 2026-01-19 · Atualizado 2026-01-24 · CVE-2026-1181

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Altium Forum (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists in the Altium Forum because of insufficient server-side input sanitization of forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts. This injected script is stored and executed when other users view the affected post. Successful exploitation allows the attacker’s payload to execute within the context of the victim’s authenticated Altium 365 session, potentially enabling unauthorized access to workspace data, including design files and workspace settings. Exploitation requires a user to view a malicious forum post.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Improper Access Control

Enumeração de Fraquezas

CWE-942

CWE-79

CWE-284

Identificadores relacionados

CVE-2026-1181

Produtos afetados

Altium 365

Altium Forum

Referências · 9

• https://altium.com/platform/security-compliance/security-advisories · Nota
• https://twitter.com/CVEnew/status/2013229526050898185 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-1181 · Nota de Segurança
• https://twitter.com/CveFindCom/status/2013244820395905532 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2013250056384602464 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2013243375827251378 · Publicação no Twitter
• https://t.me/cveNotify/149490 · Publicação no Telegram
• https://twitter.com/0dayPublishing/status/2013226469858726201 · Publicação no Twitter
• https://twitter.com/cracbot/status/2015016792767578533 · Publicação no Twitter