PT-2026-3144 · Altium · Altium Support Center

Joris Aerts · Published 2026-01-15 · Updated 2026-01-16 · CVE-2026-1011

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Altium Support Center (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists in the AddComment API endpoint. The vulnerability is caused by a lack of server-side input sanitization. While the client interface applies HTML escaping, the backend stores arbitrary HTML and JavaScript received through modified POST requests. This allows for the execution of arbitrary JavaScript in the browser of users who view support cases, including those with elevated privileges. The AddComment endpoint is vulnerable. The vulnerable parameter is the POST request body.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

CVE-2026-1011

Affected Products

Altium Support Center

References · 5

• https://altium.com/platform/security-compliance/security-advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1011 · Security Note
• https://twitter.com/VulmonFeeds/status/2012058718314115214 · Twitter Post
• https://twitter.com/CVEnew/status/2012126515371135342 · Twitter Post