Stored Cross-Site Scripting Vulnerability in Altium 365 by Altium

CVE-2026-1008

What is CVE-2026-1008?

A stored cross-site scripting (XSS) vulnerability in Altium 365 enables authenticated users to exploit input fields in user profiles. Due to inadequate server-side input sanitization, attackers can inject arbitrary HTML and JavaScript payloads by using whitespace-based attribute parsing techniques. These injected scripts are saved and executed when other users access the affected profile page, posing risks such as session token theft, phishing attacks, and malicious redirects. Mitigation requires user interaction to trigger the attack, and only authenticated accounts can exploit this vulnerability.

References