CVE-2026-1010

{"id": "CVE-2026-1010", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1010", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-16T17:05:21.932214Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "affectedData": [{"vendor": "Altium", "modules": ["Workflow Engine (Part Request submit-form API)"], "product": "Altium Enterprise Server", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.0.1"}], "platforms": ["Web"], "defaultStatus": "unaffected"}]}], "published": "2026-01-15T23:15:51.323", "references": [{"url": "https://www.altium.com/platform/security-compliance/security-advisories", "tags": ["Vendor Advisory"], "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-269"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data.\n\nWhen an administrator views the affected workflow, the injected payload executes in the administrator\u2019s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) almacenado existe en el Altium Workflow Engine debido a la falta de saneamiento de entrada del lado del servidor en las API de env\u00edo de formularios de flujo de trabajo. Un usuario autenticado regular puede inyectar JavaScript arbitrario en los datos del flujo de trabajo.\n\nCuando un administrador ve el flujo de trabajo afectado, la carga \u00fatil inyectada se ejecuta en el contexto del navegador del administrador, permitiendo la escalada de privilegios, incluyendo la creaci\u00f3n de nuevas cuentas de administrador, el robo de tokens de sesi\u00f3n y la ejecuci\u00f3n de acciones administrativas."}], "lastModified": "2026-06-17T10:14:52.313", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:altium:on-prem_enterprise_server:8.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDEBB57C-6A6D-4FC9-BA14-8324F1F7661C"}], "operator": "OR"}]}], "sourceIdentifier": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79"}