CVE-2026-1010: Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation
A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data.
When an administrator views the affected workflow, the injected payload executes in the administrator’s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1010?
The severity of CVE-2026-1010 is classified as high due to its potential for privilege escalation and exploitation via stored XSS.
How do I fix CVE-2026-1010?
To fix CVE-2026-1010, ensure that input sanitization mechanisms are properly implemented in the workflow form submission APIs.
What types of attacks can be performed exploiting CVE-2026-1010?
Exploiting CVE-2026-1010 can lead to stored XSS attacks, allowing attackers to inject malicious scripts that affect user sessions.
Who is affected by CVE-2026-1010?
Users of Altium Workflow Engine with insufficient input validation on workflow forms are at risk of CVE-2026-1010.
Is CVE-2026-1010 remotely exploitable?
Yes, CVE-2026-1010 can be exploited remotely by authenticated users through the vulnerable workflow form submission APIs.