Stored XSS Vulnerability in Altium Forum for Altium 365 Users
CVE-2026-1181

9CRITICAL

Key Information:

Vendor

Altium

Status
Altium 365
Vendor
CVE Published:
19 January 2026

What is CVE-2026-1181?

A stored cross-site scripting vulnerability exists in the Altium Forum due to inadequate server-side input sanitization in forum post content. This flaw allows an authenticated attacker to inject arbitrary JavaScript into forum posts, which is then stored and executed when other users access these posts. Successful exploitation enables the attacker’s payload to run in the context of the victim’s Altium 365 session, potentially providing unauthorized access to sensitive workspace data, including design files and settings. To be exploited, users must interact with and view the malicious forum post.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Altium 365 Web <= unspecified

References

https://www.altium.com/platform/security-compliance/secur...

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.