CVE-2026-1008 Details

A stored cross-site scripting vulnerability has been identified in Altium 365 user profile text fields. This issue arises from inadequate server-side input sanitization, which enables authenticated users to inject arbitrary HTML and JavaScript payloads. The vulnerability exploits whitespace-based attribute parsing bypass techniques. Once injected, the payload is persisted and executed when other users view the affected profile page. This could lead to session token theft, phishing attacks, or malicious redirects. Exploitation requires an authenticated account and user interaction to view the modified profile.