PT-2026-3142 · Altium · Altium 365+1

Joris Aerts · Published 2026-01-15 · Updated 2026-01-16 · CVE-2026-1009

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Altium Forum (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists because of insufficient server-side input validation of forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts. This injected script is then stored and executed when other users view the compromised post. Successful exploitation allows the attacker’s code to run within the context of the victim’s authenticated Altium 365 session, potentially granting unauthorized access to workspace data, including design files and workspace settings. Exploitation requires a user to view a malicious forum post. The API endpoint for forum post creation is susceptible to this issue, allowing injection of malicious code through the forum post content. The vulnerable parameter is the forum post content itself.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Improper Access Control

Weakness Enumeration

CWE-79

CWE-284

Related Identifiers

CVE-2026-1009

Affected Products

Altium 365

Altium Forum

References · 6

• https://altium.com/platform/security-compliance/security-advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1009 · Security Note
• https://twitter.com/0dayPublishing/status/2011935446478008809 · Twitter Post
• https://twitter.com/TheHackerWire/status/2011951480153297297 · Twitter Post
• https://twitter.com/CVEnew/status/2012126519015940318 · Twitter Post