PT-2026-3140 · Altium · Altium 365

Joris Aerts · Published 2026-01-15 · Updated 2026-01-16 · CVE-2026-1008

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Altium 365 (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists in the user profile text fields. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute parsing bypass techniques. The injected payload is persisted and executed when other users view the affected profile page, potentially allowing session token theft, phishing attacks, or malicious redirects. Exploitation requires an authenticated account and user interaction to view the crafted profile.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1008

Affected Products

Altium 365

References · 4

• https://altium.com/platform/security-compliance/security-advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1008 · Security Note
• https://twitter.com/CVEnew/status/2012303270866468888 · Twitter Post